Perforce Puppet Enterprise up to 2023.8.10/2025.11.2 java_keystore_passwd command injection

Summaryinfo

A vulnerability marked as very critical has been reported in Perforce Puppet Enterprise up to 2023.8.10/2025.11.2. The affected element is an unknown function. Performing a manipulation of the argument java_keystore_passwd results in command injection. This vulnerability is identified as CVE-2026-85979. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Perforce Puppet Enterprise up to 2023.8.10/2025.11.2. It has been classified as very critical. This affects an unknown code. The manipulation of the argument java_keystore_passwd with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_keystore_passwd parameter. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system.

The advisory is shared at portal.perforce.com. This vulnerability is uniquely identified as CVE-2026-85979 since 09/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/11/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 2023.8.11 or 2025.11.3 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Service Management Software

Vendor

• Perforce

Name

• Puppet Enterprise

Version

• 2023.8.0
• 2023.8.1
• 2023.8.2
• 2023.8.3
• 2023.8.4
• 2023.8.5
• 2023.8.6
• 2023.8.7
• 2023.8.8
• 2023.8.9
• 2023.8.10
• 2025.11.0
• 2025.11.1
• 2025.11.2

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion