Akana Has a CVSS 10 RCE. The Authentication Filter Can Be Bypassed

• The Mess: Akana API Platform has a path-normalization flaw that lets an unauthenticated request slip past the authentication filter and reach a script-execution endpoint.
• The Damage: An attacker can execute arbitrary code on the Policy Manager host without credentials or user interaction.
• The Fix: Upgrade Akana to 2024.1.6, 2025.1.2, or 2026.2 and restrict access to the Policy Manager console until patched.

The authentication check exists.

The request still gets through.

That is the core of CVE-2026-85978, a critical remote-code-execution vulnerability in the Policy Manager console of Perforce Akana API Platform. The flaw was published on September 9 and carries the maximum CVSS 4.0 score of 10.0. Under CVSS 3.1, it scores 9.8.

There is no account requirement.

There is no browser click.

There is no complicated precondition hiding in the attack vector.

The vulnerable console accepts a crafted request whose path is interpreted differently by two parts of the application.

Two Components Read the Same Path Differently

Akana’s authentication filter decides whether a request needs authentication.

The servlet dispatcher then decides where that request should go.

CVE-2026-85978 lives in the gap between those decisions.

An attacker manipulates path representation so the authentication layer fails to recognize the protected destination, while the dispatcher still resolves the request to the sensitive endpoint.

That endpoint is even worse than a simple information leak.

It evaluates attacker-supplied script code without sandboxing.

The result is arbitrary code execution on the machine running the Policy Manager console.

So the attack chain is short:

crafted path → authentication bypass → script endpoint → code execution

No stolen password required.

This Is a Full Remote Attack

The CVSS 3.1 vector is:

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Every field that defenders normally hope will limit exploitation is missing:

• Network attack vector
• Low complexity
• No privileges
• No user interaction
• High confidentiality impact
• High integrity impact
• High availability impact

The CVSS 4.0 assessment goes further and gives the vulnerability a 10.0 Critical score, including high impact on systems affected after compromise.

There is currently no CISA KEV listing for the CVE, and the available CISA SSVC enrichment records exploitation as “none.” That means there is no confirmed active exploitation signal in the sources reviewed here.

That status can change quickly for a pre-auth RCE.

Akana Is Enterprise API Infrastructure

Akana is an API management platform. Its product stack includes API gateways, lifecycle management, developer portals and API analytics.

The vulnerable Policy Manager console therefore isn’t some isolated test utility.

It is part of infrastructure used to manage APIs and their policies.

An attacker who obtains code execution on that host gets a much more useful foothold than a random application server.

The practical impact depends on how the platform is deployed, what credentials the process can access and what network paths are available from the compromised host.

Three Branches Are Already Fixed

The affected-version matrix is unusually important here.

The following versions are listed as unaffected:

• Akana 2024.1.6
• Akana 2025.1.2
• Akana 2026.2

Affected releases include earlier versions in those branches, including 2024.1.0–2024.1.5, 2025.1.0–2025.1.1 and 2026.1. Versions before the 2024.1 branch are also listed as affected.

If an upgrade cannot happen immediately, Perforce’s advisory is the reference point; IONIX also recommends restricting the Policy Manager console to trusted internal networks as a temporary compensating measure.

Check the Console, Not Just the Version

Administrators should identify every exposed Akana Policy Manager instance.

Then check:

• which version is running;
• whether the console is reachable from untrusted networks;
• authentication and HTTP access logs around Policy Manager endpoints;
• unusual requests containing encoded or non-canonical path components;
• unexpected processes or outbound connections from the Akana host;
• credentials and API secrets available to the application.

A patched version is the real fix.

Network restriction is the emergency brake.

Bugstoday Opinion

There is something brutally simple about this vulnerability.

The application has an authentication filter.

The attacker does not defeat the credentials.

They make one component misunderstand the path.

The next component understands it exactly as the attacker intended.

That kind of parser disagreement has killed plenty of security boundaries before. Here it ends at a script engine with no sandbox.

A CVSS 10 unauthenticated RCE in API management infrastructure is not something to leave waiting for the next maintenance window.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

CVE-2026-85978

Perforce — Unauthenticated Remote Code Execution in Akana Policy Manager Console

CVE.org

NVD

IONIX Threat Center