CVE-2026-85978: perforce akana Improper Resolution of Path Equivalence

Vulnerability summary

CVE-2026-85978 is a critical (CVSS 10.0) Improper Resolution of Path Equivalence vulnerability in perforce akana. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.8% of scored vulnerabilities.

Timeline

1. 09-09-2026
   PublishedVulnerability first disclosed.
2. 09-09-2026
   Last modifiedVulnerability information updated.

Description

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.

• CWE-41Improper Resolution of Path EquivalenceThe product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.