Perforce
Vulnerability activity for Perforce: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 12
- Critical (CVSS 9+)
- 6
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 14
- Critical (CVSS 9+)
- 6
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.0CriticalNov 3, 2026Perforce Puppet EnterpriseCVE-2026-115732Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, w
- 9.4CriticalNov 3, 2026Perforce Puppet Enterprise Code / command injectionCVE-2026-115731Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
- 8.5HighOct 15, 2026Perforce P4 (Helix core) Privilege escalationCVE-2026-103509P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.
- 7.3HighOct 15, 2026Perforce P4 (Helix core) Path traversal / file handlingCVE-2026-103508P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3.
- 9.3CriticalOct 13, 2026Perforce Helix Authentication Service Auth bypass / access controlCVE-2026-109758Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to t
- 5.3MediumOct 5, 2026Perforce P4 (Helix Core) Auth bypass / access controlCVE-2026-103512Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.
- 5.1MediumOct 5, 2026Perforce P4 (Helix Core) Path traversal / file handlingCVE-2026-103511Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
- 9.5CriticalOct 5, 2026Perforce P4 (Helix Core)CVE-2026-103510P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.
- 7.5HighOct 5, 2026Perforce P4 (Helix Core) Path traversal / file handlingCVE-2026-103507Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.
- 9.5CriticalOct 5, 2026Perforce P4 (Helix Core)CVE-2026-100102Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
- 8.6HighSep 11, 2026Perforce AkanaCVE-2026-89212A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.
- 9.8CriticalSep 9, 2026Perforce Akana Code / command injectionCVE-2026-85978An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
- 7.7HighMay 18, 2026Perforce P4 (Helix Core) Code / command injectionCVE-2026-6902A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.
- 7.5HighDec 20, 2025Perforce delphix continuous compliance Information disclosureCVE-2025-14591In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files, an issue was identified: using an incorrect EOR configuration can cause inaccurate parsing and leave personally identifiable information (PII) unmasked.
Top products
- P4 (Helix Core)8 CVEs in the last year, 2 critical
- Puppet Enterprise2 CVEs in the last year, 2 critical
- Akana2 CVEs in the last year, 1 critical
- Helix Authentication Service1 CVE in the last year, 1 critical
- delphix continuous compliance1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.