EUVD-2026-76103
GHSA-58hf-8fhw-r5mw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote XML input with low complexity (PR:N/AC:L); XXE reads files and reaches backend systems so scope changes (S:C) with high confidentiality, minor integrity, no availability impact.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.
AnalysisAI
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse improperly restricted external references during XML-to-JSON processing. Affected builds are 2026.1, 2025.1.1, and every release before 2024.1.6 (including older unsupported versions); Perforce has shipped a security patch in the latest supported releases. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an Akana endpoint that accepts attacker-supplied XML and routes it through the vulnerable XML-to-JSON processing path; the attacker must be able to submit XML containing a DOCTYPE/external-entity declaration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H, SC:H, SI:L) describes a clean unauthenticated, low-complexity, no-interaction network attack with high confidentiality impact on the vulnerable system and a subsequent-system confidentiality impact of High - consistent with XXE used for local file disclosure and SSRF into adjacent/backend systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Perforce security patch included in the latest release of the supported Akana versions (upgrade off 2026.1, 2025.1.1, and any build before 2024.1.6 to the patched supported release; consult the Perforce portal advisory at https://portal.perforce.com/s/cve/a91Qi000003CxPBIA0/xml-external-entity-in-akana-api-platform for the exact patched build for your track). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Akana instances and current versions; audit network exposure and internet accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Polic
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Rated
An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2.
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input dat
Helix Core Server (P4D) before 2026.1 ships with insecure default configurations allowing remote unauthenticated attacke
Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mecha
In Helix Sync versions prior to 2024.1, a local command injection was identified. Rated high severity (CVSS 7.8), this v
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Rated high severity (CVSS 7.5), this v
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was id
Share
External POC / Exploit Code
Leaving vuln.today