CVE-2026-89212

XML External Entity in Akana API Platform

View on CVE.org
Published Sep 11, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Description
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

Analysis

AI-generated

Technical impact

The flaw allows an attacker to inject or access XML external entities when Akana API Platform performs XML to JSON conversion. Because the system does not properly restrict references, the vulnerability can expose internal files or resources, leading to unauthorized data disclosure. The weakness is classified as CWE-611 and does not include denial‑of‑service in the provided description.

Affected Systems

The affected product is Perforce Akana API Platform. Versions 2026.1, 2025.1.1, and all releases prior to 2024.1.6, including unsupported older releases, are affected. A security patch that fixes the flaw has been released for supported versions.

Risk and Exploitability

The vulnerability has a CVSS score of 9.2, indicating high severity. No EPSS data is available and the CVE is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted XML payload to an endpoint that processes XML input, exploiting the unchecked external entity references. While no publicly documented exploit code is referenced, the nature of the XXE flaw suggests that such an attack could be feasible if the endpoint is accessible.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch for Akana API Platform, which disables the vulnerable XML‑to‑JSON processing path.
  • If a patch cannot be applied immediately, reconfigure the XML parser used by Akana to reject external entity references or enforce a strict whitelist of allowed entities during conversion.
  • Limit access to API endpoints that accept XML input to trusted, authenticated clients only, to reduce the attack surface.

Generated by OpenCVE AI on September 11, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Perforce
Perforce akana Api
Vendors & Products Perforce
Perforce akana Api
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.
Title XML External Entity in Akana API Platform
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N'}
Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference

Sources

Status
PUBLISHED
Assigner
Perforce
Published
Updated
Sep 11, 2026, 1:57 PM
Reserved
Sep 11, 2026, 7:46 AM

View source JSON

Updated
Sep 11, 2026, 1:57 PM

JSON

Status
Awaiting Analysis
Published
Sep 11, 2026, 2:17 PM
Modified
Sep 18, 2026, 7:30 PM

View source JSON

No data.

Updated
Sep 13, 2026, 7:15 PM

JSON