CVE-2026-85978: Akana API Platform Policy Manager RCE Flaw

CVE-2026-85978 Overview

CVE-2026-85978 is an unauthenticated remote code execution vulnerability in the Policy Manager console of the Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher lets a crafted request bypass authentication. The request reaches an endpoint that evaluates attacker-supplied script code without sandboxing, producing arbitrary code execution. Exploitation requires no authentication and no user interaction. The vulnerability is classified under [CWE-41] Improper Resolution of Path Equivalence.

Critical Impact
An unauthenticated network attacker can execute arbitrary code on the Akana Policy Manager host, compromising confidentiality, integrity, and availability of the API platform and downstream systems.

Affected Products

Akana API Platform - Policy Manager console
Perforce Akana (see vendor advisory for affected build ranges)
Deployments exposing the Policy Manager console to untrusted networks

Discovery Timeline

2026-09-09 - CVE-2026-85978 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-85978

Vulnerability Analysis

The flaw combines two defects reachable in a single HTTP request. First, the authentication filter and the servlet dispatcher normalize request paths differently. This discrepancy lets an attacker craft a URI that the filter treats as a benign or public path while the dispatcher routes the request to a protected endpoint. Second, the endpoint reached after bypass evaluates script content supplied in the request without sandboxing or input restrictions.

The combined result is unauthenticated arbitrary code execution in the context of the Policy Manager process. Because the Policy Manager governs API policy enforcement, an attacker gaining code execution can pivot to backend services, exfiltrate credentials, alter policy definitions, and disrupt API traffic.

Root Cause

The root cause is improper resolution of path equivalence [CWE-41]. Inconsistent handling of characters such as path separators, encoded segments, semicolons, and trailing elements causes the security filter to canonicalize the URL to a different resource than the dispatcher resolves. This class of parser-differential flaw defeats access control that relies on string matching against a normalized path.

Attack Vector

An attacker sends an unauthenticated HTTP or HTTPS request to the Policy Manager console. The request path is crafted so the authentication filter concludes no protected resource is being accessed. The dispatcher then routes the request to a script-evaluation endpoint, which executes attacker-supplied code. No credentials, tokens, or user interaction are required. Refer to the Perforce Security Advisory on RCE for vendor technical detail.

No verified public proof-of-concept code is currently available. Exploitation details are described in prose because no sanitized exploit code has been released.

Detection Methods for CVE-2026-85978

Indicators of Compromise

Unauthenticated HTTP requests to Policy Manager console paths that contain unusual encodings, mixed separators, semicolons, or double slashes
Policy Manager processes spawning shells, script interpreters, or outbound network connections to unfamiliar hosts
New or modified files in Akana web application directories that were not deployed by administrators
Anomalous script evaluation entries or stack traces in Policy Manager application logs

Detection Strategies

Inspect web server and reverse-proxy access logs for requests that contain path traversal characters or encoded separators followed by administrative endpoint names
Compare authentication filter decisions against servlet dispatcher routing decisions for the same request, and alert on divergence
Baseline the child-process tree of the Policy Manager JVM and alert on any deviation, particularly command interpreters

Monitoring Recommendations

Forward Policy Manager application, access, and audit logs to a centralized analytics platform for retention and correlation
Monitor outbound connections from Akana hosts to detect command-and-control or data exfiltration following exploitation
Track configuration and policy changes in the Policy Manager to identify unauthorized modifications made through code execution

How to Mitigate CVE-2026-85978

Immediate Actions Required

Apply the vendor patch referenced in the Perforce Security Advisory on RCE as the primary remediation
Restrict network access to the Policy Manager console to trusted management networks only, using firewall or reverse-proxy access control lists
Review Policy Manager hosts for signs of prior exploitation, including unexpected files, processes, and outbound connections
Rotate credentials, API keys, and signing material accessible from the Policy Manager host if compromise is suspected

Patch Information

Perforce has published a security advisory covering this vulnerability. Administrators should consult the Perforce Security Advisory on RCE for fixed versions, upgrade procedures, and vendor-provided integrity checks. Apply the patch to all Policy Manager instances, including non-production environments.

Workarounds

Place the Policy Manager console behind a web application firewall configured to block requests containing suspicious path encodings, mixed separators, and semicolon path parameters
Require mutual TLS or VPN access to the console until the patch is applied
Disable or block external routing to any script-evaluation endpoints exposed by the Policy Manager if the vendor documents such endpoints

bash

# Example reverse-proxy hardening to reject suspicious path encodings
# nginx: block requests with encoded traversal or semicolon params to admin paths
location /policymanager/ {
    if ($request_uri ~* "(%2e%2e|%2f%2f|;jsessionid=|\.\.|//)") {
        return 403;
    }
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://akana_backend;
}