CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication fi…
Published: 2026-09-09 · CVSS: 10.0 · CVSS 4.0
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7