XXE in Perforce Akana
CVE-2026-89212
A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.
Vulnerability class: XXE (XML External Entity)
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Perforce Akana — versions All versions prior to 2024.1, 2026.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-89212?
- CVE-2026-89212 is a high-severity vulnerability in Perforce Akana, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.6/10. Published 2026-09-11.
- How severe is CVE-2026-89212?
- High severity. CVSS v3 base score is 8.6 out of 10.