External risk intelligence

Akana API Platform Policy Manager Unauthenticated Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-85978

The vulnerability affects the Policy Manager console of an API platform. Management consoles and API management gateways are typically deployed as internet-facing or edge services to facilitate remote administration and API traffic oversight, making them commonly reachable from the internet.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Policy Manager console of the Akana API Platform. This flaw allows unauthenticated remote code execution, meaning an attacker could potentially run arbitrary commands on the system without needing any credentials or user interaction. The main concern is to confirm if our environment is affected and assess the potential exposure.

Unauthenticated attackers can run code remotely.
API management is a critical business function.
Confirm relevance and exposure to Akana Policy Manager.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the Akana API Platform's Policy Manager console. This request bypasses authentication due to a path normalization issue, reaching an endpoint that executes un-sandboxed, attacker-supplied script code.

No authentication or user interaction needed.
Crafted request reaches vulnerable endpoint.
Arbitrary code execution is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the Policy Manager console of the Akana API Platform. This occurs when a specially crafted request bypasses authentication due to a path normalization discrepancy, leading to the evaluation of un-sandboxed, attacker-supplied script code.

Policy Manager console.
Bypassed authentication via crafted request.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Akana API Platform's Policy Manager console allows unauthenticated remote code execution due to a path normalization discrepancy. Technical leaders and security teams must first identify all instances of the Akana API Platform, confirm their external reachability and business criticality, and then assign ownership for remediation. This will likely involve collaboration between platform, network, and security teams, with vendor coordination if necessary, to plan and execute a mitigation strategy based on the assessed risk.

Platform and security teams to own the issue.
Verify external reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Akana API Platform and its Policy Manager?

Akana API Platform is a suite designed to manage, secure, and monitor application programming interfaces (APIs) throughout their lifecycle. The Policy Manager console serves as the administrative hub where teams define and enforce governance rules, such as security policies and traffic control, for these APIs. Because it acts as the central command for API operations, it is frequently integrated into network edge architectures to support distributed API management.

What does CVE-2026-85978 mean for system security?

This vulnerability involves a critical flaw categorized under Improper Neutralization of Special Elements, often associated with Code Injection (CWE-94) and Incorrect Authorization (CWE-863). In simple terms, the system fails to correctly interpret file paths in incoming requests. This discrepancy lets an attacker trick the system into bypassing login screens and accessing a sensitive area that runs code without any safety checks, resulting in full unauthorized control over the server.

How is this vulnerability triggered by an attacker?

An attacker triggers the flaw by sending a specifically formatted HTTP request to the Policy Manager console. The core issue is a path normalization mismatch, where the authentication check sees one path while the backend dispatcher sees another, allowing the request to skip security entirely. Simply browsing the site or performing standard administrative tasks does not trigger the bug; it requires a malicious, intentionally crafted request designed to exploit this specific path discrepancy.

Is my environment at risk from this vulnerability?

You should be concerned if your organization uses the Akana API Platform, particularly if the Policy Manager console is reachable from the internet. According to Halo Surface Signal, these management consoles are often deployed as edge services to facilitate remote administration, which increases the likelihood of them being exposed to public networks. Environments where the console is restricted to isolated, internal-only segments may face a reduced risk profile.

What should I do first to respond to CVE-2026-85978?

Begin by creating an inventory of all instances of the Akana API Platform within your infrastructure. Once identified, verify which instances are internet-facing versus those on protected internal networks to prioritize your response. Engage with your platform and security engineering teams to confirm the software version in use and coordinate with the vendor for official guidance or patches, while keeping business criticality in mind for your remediation plan.

References

portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.