Critical Security Vulnerability Discovered in Perforce Software – Urgent Advisory Issued - Owned by Clearlake Capital Group, L.P. (Clearlake.com)

3/2/2025

A critical security vulnerability has been identified in Perforce.com software, Owned by Clearlake Capital Group, L.P. (Clearlake.com), affecting all versions of the platform. The vulnerability, discovered by a white-hat cybersecurity collective, poses a severe risk to organizations worldwide, as it allows an attacker to gain full administrative access to the system without authentication.

A Pattern of Security Vulnerabilities in Perforce Software

This is not the first time Perforce Software has been exposed for critical security flaws.

In December 2023, Microsoft disclosed a critical remote code execution (RCE) vulnerability in Perforce Helix Core Server, warning that attackers could exploit the flaw to gain complete control over affected systems.

An RCE vulnerability of this magnitude allows an attacker to execute arbitrary code on a target system, which means they could install persistent backdoors, deploy malware, or create hidden user accounts with administrative privileges.

Once a backdoor is installed, attackers could maintain long-term, undetected access to an organization's Perforce infrastructure, enabling covert data exfiltration, intellectual property theft, and even supply chain attacks against downstream users.

With this new authentication bypass vulnerability, attackers now have yet another method to gain unauthorized access, reinforcing the pattern of security weaknesses within Perforce’s architecture.

Microsoft: Critical RCE Backdoor Vulnerability in Helix Core Server

With yet another major vulnerability now discovered in Perforce software—this time in its authentication protocol—it raises serious concerns about the security posture of Perforce's software architecture. Organizations relying on Perforce must recognize this repeated pattern of security lapses and take proactive steps to mitigate risks associated with its software.

About Perforce.com and Its Role in the Software Industry

Perforce Software, Owned by Clearlake Capital Group, L.P. (Clearlake.com), is a globally recognized provider of enterprise version control, DevOps, and software development tools. Organizations across industries—including gaming, finance, healthcare, automotive, and government sectors—rely on Perforce’s high-performance version control and collaboration solutions to manage their source code, digital assets, and compliance needs.

Its flagship product, Helix Core, is widely used for large-scale version control, enabling development teams to collaborate on massive codebases. Additionally, Perforce offers tools for static code analysis, Agile planning, CI/CD pipelines, and digital security, making it an integral part of mission-critical infrastructure for many companies.

However, with this latest security vulnerability, Perforce’s authentication framework has been compromised, leaving organizations using its software exposed to severe risks, including data breaches, unauthorized modifications, and potential cyberattacks.

Ownership and Major Investors

Perforce Software is owned by Clearlake Capital Group, L.P. (Clearlake.com), a leading private investment firm. In April 2019, Francisco Partners, a global technology-focused private equity firm, made a significant equity investment in Perforce, becoming an equal partner with Clearlake Capital. Additionally, Antares Capital has been involved in financing Perforce's strategic acquisitions, further supporting the company's growth and expansion in the DevOps industry. ​perforce.com

Vulnerability Details

• Affected Software: All Perforce.com software
• Affected Versions: All versions
• Vulnerability Type: Authentication Bypass
• Impact: Complete Administrative Control
• Disclosure Status: Submitted to global security databases & Perforce.com notified

Severity and Potential Impact

This vulnerability compromises the core authentication protocol within Perforce software, Owned by Clearlake Capital Group, L.P. (Clearlake.com), allowing an attacker to bypass security mechanisms and take full control of the administration interface. This means that an unauthorized user could:

• Execute system-wide administrative commands
• Modify, delete, or exfiltrate sensitive data
• Escalate user privileges and create unauthorized accounts
• Deploy malicious code or manipulate software repositories
• Cause widespread disruption to businesses and organizations relying on Perforce infrastructure

Perforce software is used in security-conscious industries such as government, defense, and finance, where source code integrity is paramount. This vulnerability raises critical concerns about national security risks, intellectual property theft, and compliance violations for regulated industries.

Disclosure and Global Security Submissions

This vulnerability has been immediately reported to Perforce.com and has been formally submitted to the following cybersecurity databases:

• CVE (Common Vulnerabilities and Exposures)
• NVD (National Vulnerability Database)
• CVE Details
• Exploit-DB
• VulDB
• Rapid7
• CXSecurity

Security researchers emphasize that immediate action is required to mitigate the risk posed by this vulnerability. Organizations using Perforce software should implement temporary security controls and await official patches from the vendor.

Urgent Recommendations for Organizations

Until an official patch is released, organizations using Perforce software are strongly advised to:

1. Restrict administrative access to trusted internal networks only.
2. Monitor network traffic for unusual authentication attempts.
3. Implement additional firewall rules to block unauthorized access.
4. Audit system logs for indicators of compromise.
5. Disable external access to Perforce servers where possible.
6. Stay updated on vendor announcements and security patches.

A Call for Immediate Action

Given the high risk associated with this vulnerability, security professionals, IT administrators, and businesses using Perforce.com software must act swiftly to secure their systems. Perforce.com has been officially notified, as has Clearlake Capital Group, L.P. (Clearlake.com), and the security community expects an urgent response with mitigation measures and an emergency patch.

Perforce’s repeated exposure to critical security vulnerabilities highlights the need for organizations to continuously evaluate and harden their security infrastructure when using its products. The software development and cybersecurity communities will be closely watching how Perforce addresses this issue in the coming days.

For further updates, organizations should monitor official CVE databases and security advisories.

For inquiries regarding this security disclosure, please contact:

Whitehat Collective Worldwide
Cybersecurity Research Team
Whitehat-Collective-Worldwide at pm.me

End of Advisory

M.