External risk intelligence

Akana API Platform XML External Entity Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-89212

The Akana API Platform is designed to manage, secure, and expose APIs. As a central gateway/platform for API traffic, its components are by design intended to interface with external requests, making the attack surface public-facing in normal deployment scenarios.

XML External Entity Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the Akana API Platform could allow unauthorized access to sensitive information by improperly processing XML data. This vulnerability affects various versions of the platform and has been addressed with a security patch in supported releases. The main concern is to confirm if this platform is in use and if it is exposed to potential threats.

Flaw in XML processing may expose data.
Important for securing API gateway traffic.
Confirm relevance and exposure of the platform.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted XML data to the Akana API Platform. Because the platform improperly handles external entity references during XML-to-JSON conversion, it could be tricked into processing malicious external XML entities. This could allow an attacker to access sensitive information or potentially disrupt services.

Accessible via network.
Triggered by processing malicious XML.
Risk of sensitive data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact systems processing XML data, potentially leading to unauthorized access or disclosure of sensitive information when the platform improperly handles external entities during XML-to-JSON conversions.

System data could be accessed.
External XML entities can be referenced.
Sensitive information disclosure may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determine ownership and exposure for the Akana API Platform XXE vulnerability by first identifying all instances of the platform across your environment. Confirm which deployments are internet-facing or process sensitive data to prioritize remediation efforts. Engage the platform or application owners to plan for the security patch deployment, considering any necessary vendor coordination.

Platform or application owners should lead.
Verify external exposure and data criticality.
Plan and coordinate patch deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Akana API Platform?

Akana is an enterprise-grade software suite used to manage, secure, and monitor application programming interfaces (APIs). It acts as a gateway that controls how services communicate, handles authentication, and performs data transformations, such as converting incoming XML requests into JSON format for internal application consumption.

What does CVE-2026-89212 mean by XML external entity (XXE) flaw?

This is a weakness categorized as CWE-611. It occurs when a program incorrectly processes XML input by allowing it to reference external resources. In this specific case, the Akana API Platform fails to properly restrict these references during XML-to-JSON processing, which could allow unauthorized parties to trick the system into revealing sensitive data that it should not be accessing.

How is this vulnerability triggered?

An attacker triggers this bug by sending specially crafted XML data to the Akana API Platform. The platform attempts to convert this malicious XML into JSON, and during that conversion, it follows unauthorized references to external entities. If the XML payload does not contain these specific, malicious entity references, the platform simply processes the data as intended without triggering the vulnerability.

Is my Akana installation at risk?

According to Halo Surface Signal, this platform is typically deployed as a central gateway specifically intended to handle external traffic, making it highly likely that your instance is internet-facing. If your organization uses an affected version of Akana to process incoming network traffic, it should be considered relevant and prioritized for review.

What should I do to address this issue?

Begin by identifying all instances of the Akana API Platform running in your environment. Prioritize those that are exposed to the internet or handle sensitive data. Once identified, work with the relevant application or platform owners to coordinate the application of the official security patch provided by the vendor to remediate the vulnerability in your supported deployments.

References

portal.perforce.com/s/cve/a91Qi000003CxPBIA0/xml-external-entity-in-akana…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.