CVE-2026-6043

Insecure Default Configuration in P4 Server

8.8 HighPublic exploit

P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

1.26%Up 1.2 points since Apr 24, 2026

What each source reports

CVE List Score used 8.8

Insecure Default Configuration in P4 Server

Record: CVE-2026-6043
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-1188
Updated: 2026-11-02

EUVDEUVD-2026-25415 8.8

Record: EUVD-2026-25415
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rv45-r523-m576 8.8

P4 Server versions prior to 2026.1 are configured with insecure default settings that, when...

Record: GHSA-rv45-r523-m576
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-1188
Updated: 2026-11-02

NVD 8.8

Record: CVE-2026-6043
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-1188
Updated: 2026-11-02

Affected products

perforce helix core server (p4d)

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	flyingllama87/p4wned	2026-04-03

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6043 is a high vulnerability (CVSS 8.8) in Perforce Helix Core Server (p4d), published April 24, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. No source names a fixed version.