Description
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.
Published: 2026-09-11
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Patch Immediately
AI Analysis

Impact

The flaw allows an attacker to inject or access XML external entities when Akana API Platform performs XML to JSON conversion. Because the system does not properly restrict references, the vulnerability can expose internal files or resources, leading to unauthorized data disclosure. The weakness is classified as CWE-611 and does not include denial‑of‑service in the provided description.

Affected Systems

The affected product is Perforce Akana API Platform. Versions 2026.1, 2025.1.1, and all releases prior to 2024.1.6, including unsupported older releases, are affected. A security patch that fixes the flaw has been released for supported versions.

Risk and Exploitability

The vulnerability has a CVSS score of 9.2, indicating high severity. No EPSS data is available and the CVE is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted XML payload to an endpoint that processes XML input, exploiting the unchecked external entity references. While no publicly documented exploit code is referenced, the nature of the XXE flaw suggests that such an attack could be feasible if the endpoint is accessible.

Generated by OpenCVE AI on September 11, 2026 at 16:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch for Akana API Platform, which disables the vulnerable XML‑to‑JSON processing path.
  • If a patch cannot be applied immediately, reconfigure the XML parser used by Akana to reject external entity references or enforce a strict whitelist of allowed entities during conversion.
  • Limit access to API endpoints that accept XML input to trusted, authenticated clients only, to reduce the attack surface.

Generated by OpenCVE AI on September 11, 2026 at 16:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.
Title XML External Entity in Akana API Platform
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Perforce

Published:

Updated: 2026-09-11T13:57:07.579Z

Reserved: 2026-09-11T07:46:11.541Z

Link: CVE-2026-89212

cve-icon Vulnrichment

Updated: 2026-09-11T13:57:00.528Z

cve-icon NVD

Status : Received

Published: 2026-09-11T14:17:36.847

Modified: 2026-09-11T14:17:36.847

Link: CVE-2026-89212

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T16:15:05Z

Weaknesses
  • CWE-611

    Improper Restriction of XML External Entity Reference