CVE-2026-85978— Unauthenticated Remote Code Execution in Akana API Platform
Quick assessment
Affected
Perforce Akana
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Akana API Platform 的策略管理器（Policy Manager）控制台存在一个未认证的远程代码执行漏洞。由于身份验证过滤器与 Servlet 分发器之间存在路径规范化差异，攻击者可构造特定请求以绕过身份验证，并访问一个会执行攻击者提供的脚本代码且不进行沙箱隔离的端点，从而导致任意代码执行。利用此漏洞无需身份验证或用户交互。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1190.001 T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85978
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated Remote Code Execution in Akana API Platform
Source: CVE Program / CVE List V5
Vulnerability Description
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-85978
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85978
请登录查看更多情报信息。
Other References for CVE-2026-85978 (1)
IV. Related Vulnerabilities
Same vendor: Perforce
-
CVE-2026-14254
Improper Restriction of Excessive Authentication Attempts in -
CVE-2026-8804
Cleartext Storage of Sensitive Information for Puppet Resour -
CVE-2026-6902
Code Injection in Perforce P4 (Helix Core) -
CVE-2026-6043
Insecure Default Configuration in P4 Server -
CVE-2025-14591
PII Leak Due to Change in EOR Handling
Same weakness: CWE-94
-
CVE-2026-86076
n8n: Expression Sandbox Escape in Editor-UI Enables Stored C -
CVE-2026-86083
n8n: Expression Sandbox Escape via Shared Builtin Tampering -
CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector -
CVE-2026-78625
Insufficient Validation of Dashboard Application Labels in O -
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Applicati
V. Comments for CVE-2026-85978
No comments yet