Security Notice: Important Action Recommended for all Puppet Users The Perforce Puppet team has just released a security update to address two critical security vulnerabilities affecting Puppet Core, Puppet Enterprise, and Puppet Enterprise Advanced: CVE-2026-115731 (CVSS 9.4) and CVE-2026-115732 (CVSS 9.0). You’re receiving this notice because our records show you use Puppet. What’s affected: • Puppet Core: 8.22.1 and older; 9.1.2 and older • Puppet Enterprise and Puppet Enterprise Advanced: 2023.8.12 and older; 2025.12.0 and older; 2026.0.0 and older CVE-2026-115731 (Report Deserialization Code Execution): Any certificate signed by your Puppet certificate authority could be used to send a malicious payload that runs on Puppet Server. A compromised server can lead to the compromise of every system it manages. CVE-2026-115732 (Certificate Name Authorization Bypass): A certificate whose name extends an approved name may be accepted by authorization rules, allowing an attacker to impersonate a managed machine and access its configuration and any secrets provisioned to it, which can be used to attack other systems. What we recommend: Upgrade to the latest security release, which is the only complete remediation. 1. Puppet Enterprise/Advanced: 2026.0.1, 2025.12.1 or 2023.8.13 2. Puppet Core: 9.1.3 or 8.22.2 If unable to upgrade immediately, we recommend reviewing your autosign configuration and authorization rules as soon as possible. This mitigation should be considered a stop-gap, with priority being upgrade. For additional information, you can reference the Knowledge Base article or search for the CVE numbers in the CVE dashboard. Cybersecurity is a top priority at Perforce, and we are here to support you. If you have any questions about this issue, please log a case in the Perforce Support Portal. Our team is ready to assist. Thank you for your attention to this. Regards, Puppet Security Team