Quick answers
- Is CVE-2026-85978 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85978 being exploited in the wild.
- How severe is CVE-2026-85978?
- Critical severity, with a CVSS score of 9.8, published 9 September 2026.
- Which products and versions are affected?
- Perforce Akana API Platform.
- Is there a fix for CVE-2026-85978?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-85978 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-85978?
- Check whether you run Perforce Akana API Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability stems from a path normalization discrepancy between the authentication filter and the servlet dispatcher in the Policy Manager console. An attacker can craft a specially formatted request that appears legitimate to the authentication filter but is interpreted differently by the servlet dispatcher, allowing the request to bypass authentication checks. Once authenticated checks are bypassed, the request reaches an endpoint that evaluates attacker-supplied script code without sandboxing protections, enabling arbitrary code execution with the privileges of the application server. No authentication credentials or user interaction is required for exploitation.
Affected products
- Perforce Akana API Platform
Timeline
- 2026-09-09: disclosed