CVE-2026-85978 is a critical vulnerability in the Akana API Platform's Policy Manager console. A path normalization discrepancy between the authentication filter and the servlet dispatcher enables an attacker to bypass authentication. This allows the attacker to reach an endpoint that evaluates supplied script code without sandboxing, resulting in arbitrary code execution. The vulnerability can be exploited remotely without any authentication or user interaction.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the affected system with high impact on confidentiality, integrity, and availability. This can lead to full system compromise of the Policy Manager console environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates and apply any official fixes once available. Until then, restricting access to the Policy Manager console and applying network-level controls may reduce exposure.