CVE-2026-85978: CWE-94: Improper Control of Generation of Code ('Code Injection') in Perforce Akana
Affects Perforce AkanaSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 1.4% chance of exploitation in 30 days – higher than 72% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PerforceAkana | Affected
| Fixed in– |
AI-suggested
Until an official fix is available, restrict access to the Policy Manager console and monitor for suspicious activity. Avoid exposing the vulnerable endpoint to untrusted networks.
Description
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the affected system, potentially leading to full system compromise. The vulnerability bypasses authentication controls and executes attacker-supplied scripts without sandboxing, significantly increasing the risk and impact.
Summary
This vulnerability (CVE-2026-85978) in Perforce Akana API Platform's Policy Manager console is due to improper control of code generation (CWE-94) combined with a path normalization discrepancy that allows crafted requests to bypass authentication filters and reach a servlet dispatcher endpoint. This endpoint evaluates attacker-supplied script code without sandboxing, enabling unauthenticated remote code execution. The CVSS 4.0 base score is 10.0, reflecting its critical severity and the lack of required privileges or user interaction. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.