EUVD-2026-74794
GHSA-6whh-7r9p-c8q2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Akana Policy Manager console over network
-
DeliverySend path-normalization-crafted request
-
ExploitBypass authentication filter
-
ExecutionDispatcher routes to script-eval endpoint
-
PersistUnsandboxed script executed
-
ImpactArbitrary code execution on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or user interaction is required (PR:N/UI:N); exploitation needs network reachability to the Akana Policy Manager console and a request crafted to trigger the path-normalization discrepancy between the authentication filter and the servlet dispatcher, landing on the unsandboxed script-evaluation endpoint. The primary limiting factor is exposure of the console: if the Policy Manager administrative interface is segmented off from untrusted networks, remote unauthenticated attackers cannot reach the vulnerable endpoint. Affected deployments are those running Akana versions prior to patches 2024.1.6 / 2025.1.2 / 2026.2. |
| Impact | This is a genuine top-tier priority, not an inflated high-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high vulnerable- and subsequent-system impact across C/I/A) describes a remote, low-complexity, unauthenticated, no-interaction exploit that chains an auth bypass into unsandboxed code execution - the worst realistic combination, consistent with the 10.0 score. No EPSS score, CISA KEV listing, or public POC was provided, so there is no evidence of active exploitation yet; however, auth-bypass-to-RCE bugs in internet-facing API management consoles are prime targets and tend to be reverse-engineered quickly once a patch ships, so the absence of a POC should be read as 'early,' not 'low risk.' The Policy Manager console is an administrative surface that ideally is not internet-exposed, which is the main mitigating factor; any operator whose console is reachable from untrusted networks should treat this as urgent and patch immediately. Missing signals (EPSS, KEV, POC) are data gaps, not reassurance. |
| Exploit ScenarioDerived | An attacker locates an internet-reachable Akana Policy Manager console and sends a single crafted HTTP request whose path is normalized one way by the authentication filter (so it is treated as unauthenticated-allowed) and another way by the servlet dispatcher (so it routes to the unsandboxed script-evaluation endpoint). The request body carries attacker script, which the endpoint executes, giving the attacker arbitrary code execution on the host without any credentials or user interaction. No public POC is currently identified, but the conditions make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Policy Manager console host. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request slip past authentication and reach an endpoint that evaluates attacker-supplied script without sandboxing. Rated CVSS 4.0 10.0; no public exploit identified at time of analysis, but the no-auth/no-interaction profile makes this a top-priority patch.
RemediationAI
Apply the vendor-released Akana patch for your release train: 2024.1.6, 2025.1.2, or 2026.2 as appropriate, per the Perforce advisory at https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console. Until patched, restrict network access to the Policy Manager console so it is reachable only from trusted management networks or via VPN/bastion (reducing exposure but not fixing the underlying auth bypass), and place a reverse proxy or WAF in front that strictly canonicalizes and normalizes request paths before forwarding, to blunt the path-normalization differential (note this can break legitimate requests with unusual encodings and is not a guaranteed block). Monitor console access logs for anomalous requests to script-evaluation endpoints and for path-traversal/encoding tricks. Because the flaw yields code execution, rotate credentials and secrets accessible from the console host after patching if exposure is suspected.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Akana is Perforce's enterprise API management platform; the affected component is the Policy Manager console, a Java servlet-based administrative application. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): an endpoint evaluates attacker-supplied script code without sandboxing. The exploit is reachable because of a classic parser-differential/path-normalization mismatch - the authentication servlet filter and the downstream servlet dispatcher canonicalize request paths differently, so a URL that the filter treats as a public/exempt path is dispatched by the container to the protected script-evaluation endpoint. This combines an authentication bypass primitive with an unsafe script evaluator to yield pre-auth RCE. Affected product per CPE is cpe:2.3:a:perforce:akana:*:*:*:*:*:*:*:* (all versions prior to the fixed patch levels).
Know when Akana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Remote, low-complexity, unauthenticated, no-interaction auth-bypass-to-unsandboxed-code-execution; code exec beyond the vulnerable component justifies S:C with full C/I/A impact.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
DescriptionCVE.org
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
Executive ViewAI
Perforce Akana API Platform contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code on the Policy Manager console, potentially compromising entire API management infrastructure. With no vendor patch currently available and maximum CVSS severity, organizations using Akana for API governance face immediate risk of infrastructure takeover and control of API flows to downstream applications. Containment and emergency patching take priority.
Until vendor patch is released: (1) Restrict Policy Manager console network access to authorized administrators only via VPN or bastion host; (2) Deploy WAF rules to detect and block path normalization exploitation patterns; (3) Enable comprehensive audit logging of all Policy Manager API requests and script evaluation events; (4) Implement rate limiting and anomaly detection on authentication endpoints; (5) Monitor for unauthorized policy changes, unusual script execution, or changes to authentication filters; (6) Disable non-essential script evaluation features if platform configuration permits; (7) Establish incident response procedures for potential exploitation detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB