CVE-2026-100102 – Perforce P4 (Helix Core)

Perforce P4 Search 2026.4.2 closes four flaws that expose P4 (Helix Core) environments to full takeover. CVE-2026-100103 has a CVSS score of 10.0, Critical severity: container images reset the service authentication token to a publicly documented default, giving an unauthenticated attacker the highest application privilege. CVE-2026-100102 has a CVSS score of 9.5, Critical severity: container images enable an unauthenticated Java debug interface that lets an attacker run arbitrary code as the P4 Search service account. CVE-2026-103510 has a CVSS score of 9.5, Critical severity: P4 Search does not fail securely when its service authentication token is blank, granting an unauthenticated attacker top privilege. CVE-2026-103507 has a CVSS score of 7.5, High severity: the logging configuration interface does not restrict file paths, letting an attacker with the service token write arbitrary files on the host and reach code execution.

Each flaw leads toward compromise of the connected P4 Server, which holds an organization's source code and intellectual property. Three of the four need only network access and no credentials. Upgrade P4 Search to version 2026.4.2.