EUVD-2026-74794
GHSA-6whh-7r9p-c8q2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated, no-interaction auth-bypass-to-unsandboxed-code-execution; code exec beyond the vulnerable component justifies S:C with full C/I/A impact.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
AnalysisAI
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or user interaction is required (PR:N/UI:N); exploitation needs network reachability to the Akana Policy Manager console and a request crafted to trigger the path-normalization discrepancy between the authentication filter and the servlet dispatcher, landing on the unsandboxed script-evaluation endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-tier priority, not an inflated high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released Akana patch for your release train: 2024.1.6, 2025.1.2, or 2026.2 as appropriate, per the Perforce advisory at https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately isolate affected Akana API Platform instances from production networks or restrict network access to Policy Manager console to authorized administrators only; contact Perforce support for patch timeline and emergency guidance; enable detailed audit logging of all Policy Manager API requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Rated
An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2.
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse im
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input dat
Helix Core Server (P4D) before 2026.1 ships with insecure default configurations allowing remote unauthenticated attacke
Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mecha
In Helix Sync versions prior to 2024.1, a local command injection was identified. Rated high severity (CVSS 7.8), this v
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Rated high severity (CVSS 7.5), this v
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was id
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today