Patching Perforce perforations: Critical RCE vulnerability discovered in Perforce Helix Core Server

Microsoft responsibly disclosed four vulnerabilities in Perforce Helix Core Server—most critically an unauthenticated RPC allowing arbitrary command execution as LocalSystem (CVSS 10.0)—and three additional remote denial-of-service flaws; Microsoft found over 1,000 internet-exposed instances, coordinated fixes with Perforce (patch released 2023.1/2513900), and provided mitigation and detection guidance while noting no observed in-the-wild exploitation.