CVE-2026-100102
RCE via exposed JDWP debug agent in P4Search
- State
- Published
- Severity
- 9.5 Critical
- Published
- Oct 5, 2026
- Updated
- Oct 5, 2026
- Reserved
- Sep 25, 2026
Description
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.5 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | Perforce |
Weaknesses
- CWE-489 Active debug code
Affected Products
| Product | Versions |
|---|---|
P4 (Helix Core)Perforce |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.