CVE-2026-89212

HighCVSS 8.6

Published: 11/09/2026(UTC)Updated: 18/09/2026(UTC)Translated: 11/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions) and has been fixed as a security patch in the latest release of supported versions.

Risk Assessment

The XXE flaw may allow an attacker to read local files, perform SSRF attacks, or cause denial of service on the API server, potentially compromising confidentiality and availability of processed data.

Recommendation

Update Akana API Platform to the latest supported release containing the security patch, or if updating is not possible, isolate the service and restrict processing of untrusted XML documents.

Other vulnerabilities in Akana API Platform

CVE-2026-85978Critical
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy allows authentication bypass and access to an endpoint that executes attacker-supplied script code without sandboxing, leading to arbitrary code execution.

Original NVD description (English source)

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS