CVE-2026-6043 - Vulnerability Analysis

Overview

P4 Server < 2026.1 contains a broken access control vulnerability caused by insecure default settings, letting unauthenticated attackers create users, enumerate users, authenticate without passwords, and access depot contents remotely, exploit requires server exposure to untrusted networks.

Severity & Score

Impact

Unauthenticated attackers can gain unauthorized access to source code repositories and managed assets, risking data theft and manipulation.

Mitigation

Update to version 2026.1 or later which enforces secure-by-default configurations.

References

• https://help.perforce.com/helix-core/server-apps/p4sag/current/Content/P4SAG/security-configurables.html
• https://portal.perforce.com/s/cve/a91Qi000002wRUvIAM/insecure-default-configuration-in-p4-server

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner