CVE-2026-85978

CriticalCVSS 9.8/10Last modified Sep 9, 2026

Description

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-41 CWE-94 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 9, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-859798.6Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privilege CVE-2026-85989.1An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication an CVE-2026-859816.7The administrative panel of the Auth0 AD/LDAP Connector (versions 6.5.0 and earlier) listens on the local loopback interface without requiri CVE-2026-859829.0The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search result CVE-2026-859837.8The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host CVE-2026-859849.8The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login CVE-2026-859855.4MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CVE-2026-85996.4The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site CVE-2026-859908.8Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management CVE-2026-859957.3Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can ac CVE-2026-859995.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py t CVE-2026-860005.3Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parse