Is CVE-2026-6902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6902 being exploited in the wild.

How severe is CVE-2026-6902?

Informational severity, with a CVSS score of 7.7, published 18 May 2026.

Which products and versions are affected?

Perforce Helix Core P4 Server Prior to 2025.2 Patch 2.

Is there a fix for CVE-2026-6902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6902 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6902?

Check whether you run Perforce Helix Core P4 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6902: Perforce Helix Core P4 Server code injection in Command-Line Client

CVE-2026-6902 · Severity: info · CVSS 7.7 · Published 2026-05-18

A code injection vulnerability exists in the Perforce Helix Core P4 Server command-line client. Helix Core is a version control system used by large development teams to manage source code and digital assets. An attacker could exploit this flaw to execute unauthorized commands, potentially leading to full system compromise, data theft, or disruption of development operations.

Vendors: Perforce.

Quick answers

Is CVE-2026-6902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6902 being exploited in the wild.
How severe is CVE-2026-6902?: Informational severity, with a CVSS score of 7.7, published 18 May 2026.
Which products and versions are affected?: Perforce Helix Core P4 Server Prior to 2025.2 Patch 2.
Is there a fix for CVE-2026-6902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6902 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6902?: Check whether you run Perforce Helix Core P4 Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in the Command-Line Client component of Perforce P4 Server. The flaw allows an attacker to improperly control the generation of code, leading to unauthorized execution. According to the CVSS 4.0 vector, the attack is network-reachable and requires some user interaction, but carries high impact for confidentiality, integrity, and availability. The vulnerability is addressed in P4 Server version 2025.2 Patch 2.

Affected products

Perforce Helix Core P4 Server Prior to 2025.2 Patch 2

Timeline

2026-05-18: disclosed: Initial publication of CVE-2026-6902
2026-05-18: advisory: Perforce released security advisory and patch information

References

https://portal.perforce.com/s/cve/a91Qi000002zJB3IAM/code-injection-in-perforce-helix-core

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.