CVE-2026-103509CWE-1220

CVE-2026-103509

published October 15, 2026

CVSS
8.5
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation.

This affects 2026.4.2 and earlier and is fixed in 2026.4.3.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00229 · 13.0th percentile
Weakness
CWE-1220 · Insufficient Granularity of Access Control
Published
2026-10-15T19:17Z
References (1)
https://portal.perforce.com/s/cve/a91Qi000003Gdi1IAC/credential-disclosure-in-p4-search-configuration-api · [email protected]
EPSS history
Timeline
  • 17 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 15 OCT 14:41Z
    Credential Disclosure in P4 Search Configuration API
    cvelistv5
  • 15 OCT 14:41Z
    Credential Disclosure in P4 Search Configuration API
    cvelistv5