Perforce P4 Search: Remote code execution via exposed JDWP debug interface
Summary
Perforce P4 Search container images before 2026.4.2 expose an unauthenticated Java debug interface (JDWP). An attacker with network access to this interface can execute arbitrary code as the P4 Search service account. This may allow compromise of the connected P4 Server. The CVSS 4.0 base score is 9.5 (critical).
Affected
- P4 Search container images 2026.4.1 and earlier (per CNA record, affected by default)
- Native (non-container) installations: Unknown.
Fixed in
- 2026.4.2 (per CNA record and vendor advisory text)
Workaround
- No vendor workaround known.
- Restrict network access to the debug port.
- Disable the JDWP debug agent where possible (general JDWP hardening, not Perforce guidance).
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No reports of exploitation in the wild found.
- A public PoC claim exists but is unverified.
Our recommendation
- Inventory all P4 Search container images and any native installations, and check their versions.
- Upgrade to 2026.4.2 or later.
- Make sure the debug port is not reachable from user or build networks; restrict P4 Search to the P4 Server and required clients.
- Review logs for unexpected connections to the debug port and for changed service credentials.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Perforce Support Portal: RCE via exposed JDWP debug agent in P4Search portal.perforce.com
- CVE record (CNA Perforce, cvelistV5) raw.githubusercontent.com
- VulDB: CVE-2026-100102 vuldb.com
- HOL Guard: CVE-2026-100102 hol.org
- Strix: CVE-2026-100102 www.strix.ai
- Exposed JDWP exploited in the wild (NetManageIT) blog.netmanageit.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:34.
Original description (NVD)
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.