CVE-2026-100102

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: Perforce

Description

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100102

EUVD

EUVD-2026-92295

Affected Vendors & Products

Vendor	Product	Version / Range
Perforce	P4	(Helix Core) 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-489	The product is released with debugging code still enabled or active.

Attack-Flow Graph

Executive Summary

This vulnerability affects Perforce P4 Search container images before version 2026.4.2. It exposes an unauthenticated Java debug interface that allows remote attackers to execute arbitrary code as the P4 Search service account. This could lead to full compromise of the connected P4 Server if exploited.

Detection Guidance

Check if the Perforce P4 Search container is running with exposed Java debug ports (typically 8000). Use commands like 'netstat -tulnp | grep 8000' or 'ss -tulnp | grep 8000' to identify listening debug interfaces. Verify container configurations for enabled Java debug options such as '-agentlib:jdwp'.

Impact Analysis

If you use Perforce P4 Search container images prior to 2026.4.2, an attacker with network access to the Java debug interface could gain control of your P4 Search service. This may allow them to access or modify sensitive data, disrupt operations, or pivot to other systems connected to the P4 Server.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions may face legal penalties, reputational damage, and mandatory breach notifications depending on the data exposed.

Mitigation Strategies

Upgrade Perforce P4 Search to version 2026.4.2 or later to patch the vulnerability. If immediate upgrade is not possible, disable the Java debug interface by removing '-agentlib:jdwp' from container startup arguments and restrict network access to the debug port using firewall rules.

Hi! I’m here to help you understand CVE-2026-100102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70