CVE-2026-103512

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: Perforce

Description

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103512

EUVD

EUVD-2026-92307

Affected Vendors & Products

Vendor	Product	Version / Range
Perforce	P4	(Helix Core) 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

Perforce P4 Search before version 2026.4.2 has a flaw where it trusts a client-provided address during authentication. This allows an attacker with a stolen P4 Server ticket to bypass host-based restrictions and trusted-address controls, gaining unauthorized access to P4 Search as the ticket's legitimate owner.

Detection Guidance

To detect this vulnerability, check Perforce P4 Search logs for unusual authentication requests from unexpected IP addresses. Monitor for tickets being used outside trusted network ranges. Verify if any tickets are being used to access P4 Search from unauthorized hosts.

Impact Analysis

If you use Perforce P4 Search prior to 2026.4.2, an attacker could exploit this to access your P4 Search instance using a stolen ticket. This could lead to unauthorized data access, modification, or exfiltration, depending on the permissions of the compromised account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Update Perforce P4 Search to version 2026.4.2 or later to address the authentication bypass issue. Review and enforce trusted-address controls and host-based ticket restrictions to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-103512. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70