P4 Server versions before 2026.1 run with insecure default settings that enable an unauthenticated attacker to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password, and access depot contents via the built‑in "remote" user. These combined capabilities can provide an attacker full, unauthorized access to source code repositories and related assets.

The affected product is Perforce Helix Core Server (P4D). All releases prior to version 2026.1 are vulnerable. Administrators of any earlier installation should verify the version and plan remediation accordingly.

The CVSS score of 8.8 indicates a high‑severity flaw, yet the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is over an untrusted network, where an adversary can communicate with the P4D server without authentication. Exploitation requires the insecure default configuration to be present; no local privilege escalation or additional software vulnerability is required beyond the defaults.