CVE-2026-85978
CriticalCVSS 10.0Summary
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy allows authentication bypass and access to an endpoint that executes attacker-supplied script code without sandboxing, leading to arbitrary code execution.
Risk Assessment
An unauthenticated attacker can take control of the API platform, potentially leading to data confidentiality and integrity breaches and service disruption.
Recommendation
Apply vendor patches immediately and restrict access to the Policy Manager console to trusted networks only.
Related vulnerabilities
- CVE-2026-87827Critical
Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring authentication. A remote unauthenticated attacker can execute arbitrary system commands, potentially leading to complete compromise. Exploited by Mirai_ptea and Mirai_aurora botnets for malware propagation and DDoS.
- CVE-2026-79696Critical
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
- CVE-2026-16272Critical
Use of less trusted source vulnerability in PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects versions from v9.0.0 before v9.0.3.
- CVE-2026-21102Critical
Use-after-free vulnerability in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
- CVE-2026-21096Critical
Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-21095Critical
Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code.
- CVE-2026-53939Critical
In cjose versions 0.6.1 through 0.6.2.5, when encrypting a JWE using AES-CBC-HMAC content-encryption algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is encrypted and authenticated under a fixed, publicly known key, allowing anyone who obtains the JWE to recover plaintext and forge or modify content. Fixed in 0.6.2.6 by generating CEK from RAND_bytes.
- CVE-2026-53581Critical
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and write user-controlled data to any file.
- CVE-2026-85982Critical
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host, could insert script content that executes in an administrator's browser.
- CVE-2026-84869Critical
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Original NVD description (English source)
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.