CVE-2026-103508 Perforce CVE debrief

Who should care

Perforce P4 Search administrators and users with administrative privileges on the connected P4 Server should assess exposure and verify their version of P4 Search. Affected operators, platform administrators, vulnerability-management teams, and security teams should review official advisories and CVE records to validate affected scope and severity.

Why it matters

CVE-2026-103508 is a high-severity path traversal vulnerability in P4 Search that requires immediate attention from administrators. If exploited, it could lead to code execution and compromise of the P4 Search service account. Affected versions must be updated to 2026.4.3 to mitigate this risk.

• Potential code execution as the P4 Search service account
• Data integrity and confidentiality risks due to file deletion or modification
• Possible lateral movement if an attacker gains access to the P4 Search service account
• Verification of P4 Search version and logging configuration is necessary

Technical summary

CVE-2026-103508 is a path traversal vulnerability in P4 Search (formerly Helix Search) that allows an authenticated user with administrative privileges to supply a crafted logging configuration. This can cause files to be written or deleted outside the intended logging directory, potentially leading to code execution as the P4 Search service account. The issue affects P4 Search 2026.4.2 and earlier versions. Perforce has resolved this issue in version 2026.4.3.

Defensive priority

High priority for Perforce P4 Search administrators to verify and update to version 2026.4.3 if running 2026.4.2 or earlier.

Recommended defensive actions

• Verify P4 Search version and update to 2026.4.3 if running 2026.4.2 or earlier
• Restrict administrative privileges on the connected P4 Server
• Monitor P4 Search logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program and NVD records confirm the vulnerability in P4 Search. Vendor Perforce has provided a resolution in version 2026.4.3. Evidence limits suggest verifying P4 Search version and logging configuration. Defensive verification tasks include reviewing official advisories and CVE records for affected scope and severity. Confirm whether affected product deployments exist in managed environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.