PT-2026-34875 · Perforce · P4 Server

Published 2026-04-24 · Updated 2026-04-25 · CVE-2026-6043

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions P4 Server versions prior to 2026.1

Description Insecure default settings allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts without passwords, and access depot contents using the built-in 'remote' user when the system is exposed to untrusted networks. These configurations can result in unauthorized access to managed assets and source code repositories.

Recommendations Update to version 2026.1 to enforce secure-by-default configurations.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-6043

Affected Products

P4 Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-6043 · Security Note
• https://twitter.com/CVEnew/status/2048099295866376361 · Twitter Post
• https://help.perforce.com/helix-core/server-apps/p4sag/current/Content/P4SAG/security-configurables.html · Note
• https://help.perforce.com/helix-core/server-apps/p4sag/current/Content/P4SAG/secure-by-default-overview.html · Note
• https://portal.perforce.com/s/cve/a91Qi000002wRUvIAM/insecure-default-configuration-in-p4-server · Note