Perforce Helix Core Server (P4D) versions before 2026.1 have insecure default configurations that expose the server to unauthenticated remote attacks. Attackers can create arbitrary user accounts, enumerate existing users, authenticate to accounts lacking passwords, and access depot contents through the built-in 'remote' user. These vulnerabilities stem from initialization of resources with insecure defaults (CWE-1188). The 2026.1 release will address these issues by enforcing secure-by-default settings on upgrades and new installations.

The vulnerability allows unauthenticated remote attackers to gain unauthorized access to source code repositories and managed assets by creating user accounts, enumerating users, and authenticating without passwords. This compromises confidentiality and integrity of the repository contents. The CVSS 4.0 score is 8.8 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor plans to release version 2026.1 in May 2026, which will enforce secure-by-default configurations on upgrade and new installations. Until then, administrators should consider restricting network exposure of the server and manually hardening configurations to prevent unauthorized access.