Critical severity · published Oct 5, 2026
CVE-2026-100102
RCE via exposed JDWP debug agent in P4Search
9.5
CVSS
0.4%
EPSS
No
On KEV
Description
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
P4 (Helix Core) · Perforce
through 2026.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100102
portal.perforce.com
https://portal.perforce.com/s/cve/a91Qi000003FE7NIAW/rce-via-exposed-jdwp-debug-agent-in-p4search
More from P4 (Helix Core)
9.5
CVE-2026-103510
Authentication bypass via blank auth token in P4Search
8.5
CVE-2026-103509
Credential Disclosure in P4 Search Configuration API
7.7
CVE-2026-6902
Code Injection in Perforce P4 (Helix Core)
7.5
CVE-2026-103507
Arbitrary file-write via log configuration path in P4Search
7.3
CVE-2026-103508
Path traversal via logging configuration in P4Search