CVE-2026-109758 Perforce CVE debrief

Who should care

Defenders responsible for Perforce Helix Authentication Service (HAS) deployments should assess exposure and prioritize remediation. This vulnerability can be chained with CVE-2026-61834 to disrupt service availability and potentially enable remote code execution.

Why it matters

CVE-2026-109758 is a critical vulnerability in Perforce Helix Authentication Service (HAS) that allows unauthorized access to the SCIM API. Defenders should assess exposure, prioritize remediation, and verify HAS version and configuration to prevent potential exploitation.

• Potential unauthorized access to the SCIM API
• Possible disruption of service availability
• Potential remote code execution in certain deployments
• Verification of HAS version and configuration is required

Technical summary

The vulnerability exists in Perforce Helix Authentication Service (HAS) versions 2022.1 - 2025.2. The installation templates contain a default credential which is not automatically replaced with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations. This issue can be chained with CVE-2026-61834 to disrupt service availability and potentially enable remote code execution in certain deployments. Defenders should assess exposure, prioritize remediation, and verify HAS version and configuration to prevent potential exploitation.

Defensive priority

High

Recommended defensive actions

• Review and update Perforce Helix Authentication Service (HAS) deployments to ensure the default SCIM bearer token is replaced with a random token.
• Verify the version of HAS is 2026.1 or later, or apply vendor-provided patches.
• Restrict access to the SCIM endpoint to prevent unauthorized access.
• Monitor for suspicious activity and implement compensating controls to detect potential exploitation.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, the corpus does not establish versions, exploitation, impact, or remediation for all affected deployments, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.