{"schemaVersion":3,"id":"CVE-2026-85978","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.","dates":{"published":"2026-09-09T10:31:55.863Z","modified":"2026-09-09T14:19:29.425Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"critical","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":10,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":10,"severity":"critical","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01439,"percentile":0.728,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.562,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00877},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01439,"percentile":0.728}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00877,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01439,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01439,"percentile":0.728}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-41","name":"Improper Resolution of Path Equivalence","description":"The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/41.html"},{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"},{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"perforce","product":"akana","name":"Akana","label":"akana","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions prior to 2024.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2024.1.0, ≤ 2024.1.5","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2025.1.0, ≤ 2025.1.1","noFixRecorded":false,"fixedIn":null},{"text":"2026.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions prior to 2024.1 | ≥ 2024.1.0, ≤ 2024.1.5 | ≥ 2025.1.0, ≤ 2025.1.1 | 2026.1","eol":null,"hubHref":"/vendor/perforce/akana"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console","label":"portal.perforce.com/s/…","hostname":"portal.perforce.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-09T10:31:55.863Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-09T14:19:29.425Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T00:05:55.494Z","stale":false,"partial":false}}