Perforce vulnerabilities
We track 22 vulnerabilities in Perforce products across 9 products. 22 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest Perforce vulnerabilities
- 9.0 Critical severity
Puppet Enterprise: Incorrect Comparison
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authoriz
- 9.4 Critical severity
Puppet Enterprise: Improper Control of Generation of Code
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by subm
- 8.5 High severity
P4 (Helix core): Insufficient Granularity of Access Control
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.
- 7.3 High severity
P4 (Helix core): Relative Path Traversal
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could
- 9.3 Critical severity
Helix Authentication Service: Use of Hard-coded Credentials
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain
- 9.5 Critical severity
P4 (Helix Core): Not Failing Securely
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4
- 7.5 High severity
P4 (Helix Core): External Control of File Name or Path
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 S
- 9.5 Critical severity
P4 (Helix Core): Active Debug Code
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connec
- 8.6 High severity
Akana: Improper Restriction of XML External Entity Reference
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older uns
- 9.8 Critical severity
Akana: Improper Resolution of Path Equivalence
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication a
- 8.3 High severity
Delphix Continuous Data: Improper Restriction of Excessive Authentication Attempts
A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were
- 7.7 High severity
P4 (Helix Core): Improper Control of Generation of Code
A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.
- 8.8 High severity
Helix Core Server (P4D): Initialization of a Resource with an Insecure Default
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password se
- 7.5 High severity
Delphix Continuous Compliance: Exposure of Sensitive Information to an Unauthorized Actor
In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) characters in delimited files, an issue was identified: using an incorrect EOR configuration can cause inacc
- 8.8 High severity
Puppet Enterprise: Improper Neutralization of Special Elements used in an OS Command
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versi
- 9.0 Critical severity
Delphix: Improper Access Control
A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in Connector functionality to access Continuous Compliance’s internal database. This allows
- 8.5 High severity
Delphix: Privilege Defined With Unsafe Actions
An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive dat
- 8.7 High severity
Helix Core: Uncontrolled Resource Consumption
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Karol Więsek.
- 8.7 High severity
Helix Core: Uncontrolled Resource Consumption
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the refuse function was identified. Reported by Karol Więsek.
- 8.7 High severity
Helix Core: Uncontrolled Resource Consumption
In Helix Core versions prior to 2024.2, an unauthenticated remote Denial of Service (DoS) via the auto-generation function was identified. Reported by Karol Więsek.
- 7.5 High severity
Helix Core: Uncontrolled Resource Consumption
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner.
- 7.5 High severity
Helix Core: Uncontrolled Resource Consumption
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner.