CVE-2026-40176

CVE

Threat entity extracted from intelligence sources

Frequency

3

occurrences

First Seen

April 14, 2026

Last Seen

April 16, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Command Injection Vulnerabilities in Composer's Perforce Driver72.0

Two command injection vulnerabilities, CVE-2026-40176 and CVE-2026-40261, have been identified in Composer's Perforce VCS driver, allowing attackers to execute arbitrary commands on user systems. CVE-2026-40176, affecting the Perforce::generateP4Command() method, can be exploited through malicious P...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Command Injection Vulnerabilities in Composer's Perforce Driver

Apr 15·3 sources

Related Articles (3)

PHP Composer vulnerabilities allow arbitrary command execution | brief

Scworld·Apr 16

Composer 2.9.6 Fixes Two Perforce Command Injection Vulnerabilities

Laravel-News·Apr 15

Composer 2.9.6: Perforce Driver Command Injection Vulnerabilities (CVE-2026 ...

Blog.Packagist·Apr 14

Related Entities

Command Injection Zero-day Exploit CVE-2026-40261 CWE-20 - Improper Input Validation CWE-78 - OS Command Injection T1059 - Command and Scripting Interpreter Perforce VCS Perforce VCS Driver PHP Composer Composer