CVE-2026-89212

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

Scoring

Severity

CRITICAL

CVSS base score

9.2

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

EPSS probability

0.33%

CWE

CWE-611

Published

2026-09-11

Last modified

2026-09-11

Affected products

• Perforce Akana
• Perforce Akana
• Perforce Akana
• Perforce Akana
• Perforce Akana
• Perforce Akana
• Perforce Akana
• Perforce Akana

Weakness type

• CWE-611

Related vulnerabilities

• CVE-2025-58360 — GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
• CVE-2025-2776 — SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
• CVE-2025-2775 — SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
• CVE-2025-68493 — Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
• CVE-2025-11700 — N-central Multiple XXE Injection Vulnerabilities
• CVE-2025-2777 — SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
• CVE-2025-30220 — GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
• CVE-2026-32251 — Tolgee has an XXE Injection in Translation Import

Markdown version · Browse all CVEs