# CVE-2026-85978: Akana API Platform Policy Manager console unauthenticated code execution

Source: https://junglewise.ai/threats/cve-2026-85978-akana-api-platform-policy-manager-console-unauthenticated-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85978 · Severity: critical · CVSS 9.8 · Published 2026-09-09

Akana API Platform's Policy Manager console is vulnerable to unauthenticated remote code execution. An attacker can craft a malicious request that bypasses authentication protections and reaches an endpoint capable of executing arbitrary code, potentially allowing complete compromise of the API management system and any APIs it controls.

Vendors: [Perforce](https://junglewise.ai/threats/vendors/perforce).

## Quick answers

**Is CVE-2026-85978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85978 being exploited in the wild.

**How severe is CVE-2026-85978?** Critical severity, with a CVSS score of 9.8, published 9 September 2026.

**Which products and versions are affected?** Perforce Akana API Platform.

**Is there a fix for CVE-2026-85978?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85978 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85978?** Check whether you run Perforce Akana API Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from a path normalization discrepancy between the authentication filter and the servlet dispatcher in the Policy Manager console. An attacker can craft a specially formatted request that appears legitimate to the authentication filter but is interpreted differently by the servlet dispatcher, allowing the request to bypass authentication checks. Once authenticated checks are bypassed, the request reaches an endpoint that evaluates attacker-supplied script code without sandboxing protections, enabling arbitrary code execution with the privileges of the application server. No authentication credentials or user interaction is required for exploitation.

## Affected products

- Perforce Akana API Platform

## Timeline

- 2026-09-09: disclosed

## References

- [https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console](https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console)

## Related threats

- [Akana API Platform XML external entity injection in XML-to-JSON processing](https://junglewise.ai/threats/cve-2026-89212-akana-api-platform-xml-external-entity-injection-in-xml-to-json)