Unverified50% confidenceFactExact time
Perforce's SCIM PATCH path parser fails to properly filter input, allowing attackers to construct malicious paths that break out of the intended attribute modification scope, and in some tests even allowing arbitrary code execution.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/13/2026
First Seen
Valid until: 1/11/2027
Sources
Related Entities
Related Claims
UnverifiedPerforce disclosed the CVE-2026-109758 vulnerability, which involves issues with default tokens and a PATCH path parser in its SCIM implementation.74% similarUnverifiedPerforce's SCIM implementation allows authentication using the default bearer token publicly documented in the documentation and does not mandate changing it, so an attacker only needs to know the token value to call the SCIM API with administrator privileges.67% similarUnverifiedStealthy false data injection refers to attackers carefully crafting tampered data to bypass conventional anomaly detection mechanisms.62% similarUnverifiedsafetensors格式避免了PyTorch .bin格式使用pickle序列化带来的任意代码执行风险，但无法防御模型参数本身编码的恶意行为61% similarUnverifiedAgent security risks are often not code vulnerabilities but semantic-level manipulation, which is difficult to cover with conventional penetration testing tools.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1019875API
curl https://kongchang.com/api/v1/knowledge/claims/1019875MCP
get_claim(id=1019875)