CVE-2026-6902: P4 Helix Core Server RCE Vulnerability

CVE-2026-6902 Overview

CVE-2026-6902 is a Remote Code Execution vulnerability in the Perforce Helix Core (P4) Server's Command-Line Client. The flaw exists in versions prior to 2025.2 Patch 2 and is classified under CWE-94: Improper Control of Generation of Code. Attackers can leverage the issue to inject and execute arbitrary code through the P4 client. Perforce has issued a security advisory and addressed the vulnerability in the latest patch release.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code in the context of the Helix Core command-line client, potentially compromising source code repositories and developer workstations.

Affected Products

• Perforce Helix Core (P4) Server Command-Line Client prior to 2025.2 Patch 2
• Development environments relying on the P4 CLI for source control operations
• CI/CD pipelines integrated with vulnerable Helix Core clients

Discovery Timeline

• 2026-05-18 - CVE-2026-6902 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-6902

Vulnerability Analysis

The vulnerability is a code injection flaw [CWE-94] in the Helix Core Command-Line Client. Improper handling of input allows an attacker to influence the code execution flow within the P4 client process. The issue is network-reachable and requires user interaction, such as a developer running a P4 command that processes attacker-controlled input or connects to a malicious server.

Because the P4 client is commonly used in software development workflows, exploitation can compromise source code integrity, leak intellectual property, or pivot to other systems within a developer's environment. Perforce's advisory confirms the fix is included in the 2025.2 Patch 2 release.

Root Cause

The root cause is improper control of code generation within the Helix Core command-line client. The client fails to adequately sanitize or validate input that ultimately influences executed instructions, enabling attacker-supplied data to be interpreted as code rather than data.

Attack Vector

The attack vector is network-based and requires limited user interaction. An attacker can craft malicious responses or repository content delivered to a vulnerable P4 client. When a developer invokes the client against a malicious or compromised Helix Core server, the injected payload executes locally on the developer's machine.

No public proof-of-concept exploit is currently available. Refer to the Perforce Security Advisory for vendor-confirmed technical context.

Detection Methods for CVE-2026-6902

Indicators of Compromise

• Unexpected child processes spawned by the p4 command-line client binary
• P4 client connections to untrusted or unknown Helix Core server endpoints
• Anomalous outbound network traffic from developer workstations following P4 operations

Detection Strategies

• Inventory all systems running the P4 command-line client and identify versions prior to 2025.2 Patch 2
• Monitor process execution chains where p4 is the parent process and flag shell, scripting, or LOLBin children
• Inspect P4 client logs for connections to unauthorized server addresses or unusual command sequences

Monitoring Recommendations

• Enable endpoint behavioral monitoring on developer workstations and CI/CD runners that use Helix Core
• Correlate process telemetry with network connection events involving the default P4 port 1666
• Alert on outbound connections from P4 clients to IP addresses outside the approved Perforce infrastructure

How to Mitigate CVE-2026-6902

Immediate Actions Required

• Upgrade the Perforce Helix Core command-line client to 2025.2 Patch 2 or later on all endpoints
• Audit CI/CD systems, build agents, and developer workstations for vulnerable P4 client installations
• Restrict P4 client connections to known and trusted Helix Core server endpoints only

Patch Information

Perforce has released the fix in Helix Core 2025.2 Patch 2. Administrators should consult the Perforce Security Advisory for download instructions and version verification guidance.

Workarounds

• Block outbound connections from developer workstations to untrusted Helix Core servers using host or network firewalls
• Enforce allowlists of approved P4 server addresses in client configuration files
• Run P4 client commands only against verified, internal repositories until patching is complete

# Verify the installed P4 client version
p4 -V

# Restrict outbound P4 connections to the trusted server
# Example iptables rule (replace TRUSTED_SERVER_IP with your Helix Core host)
iptables -A OUTPUT -p tcp --dport 1666 -d TRUSTED_SERVER_IP -j ACCEPT
iptables -A OUTPUT -p tcp --dport 1666 -j DROP