CVE-2026-85978: Perforce Akana, инжекция

Описание

Оригинално описание

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.

Засегнати продукти

• Perforce Akana: 2024.1.6, 2025.1.2, 2026.2; All versions prior to 2024.1; 2024.1.0 до 2024.1.5; 2025.1.0 до 2025.1.1; 2026.1

Вид слабост

• CWE-94 Неправилен контрол при генериране на код
• CWE-41 Неправилна обработка на еквивалентни пътища
• CWE-863 Incorrect Authorization

История

Други уязвимости в Perforce Akana

• 9.2CVE-2026-89212

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-85978
• https://nvd.nist.gov/vuln/detail/CVE-2026-85978
• https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console