Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-85978

Unauthenticated Remote Code Execution in Akana API Platform

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Perforce

Description

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Perforce Akana

Default version status: affected

  • 2024.1.6, 2025.1.2, 2026.2unaffected
  • All versions prior to 2024.1affected
  • 2024.1.0 to ≤ 2024.1.5affected
  • 2025.1.0 to ≤ 2025.1.1affected
  • 2026.1affected

References