CVE-2026-85978

CVE-2026-85978 is an unauthenticated remote code execution flaw in the Policy Manager console of the Akana API Platform. A path normalization discrepancy between the console's authentication filter and its servlet dispatcher lets a crafted request bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing. A remote, unauthenticated attacker can therefore execute arbitrary code on the server hosting the console, with no user interaction required. Any deployment exposing the Akana API Platform Policy Manager console is affected. As of the current data, the flaw is not listed in CISA's KEV, no public proof-of-concept is known, and there are no confirmed reports of in-the-wild exploitation.

What to do: Upgrade Akana API Platform to the patched release identified in the vendor security advisory, since no specific fixed version numbers are provided in this data. Until patched, restrict network access to the Policy Manager console (allow only trusted management networks or place it behind a VPN/WAF) and review access logs for unauthenticated requests that reach Policy Manager endpoints, particularly those containing path traversal or normalization variants. Confirm that any internet-exposed console instances are prioritized for patching.