CVE-2026-89212CWE-611xxe

CVE-2026-89212

High · published September 11, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS
0.00440 · 37.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-09-11T18:17Z
References (1)
https://portal.perforce.com/s/cve/a91Qi000003CxPBIA0/xml-external-entity-in-akana-api-platform · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 13:23Z
    XML External Entity in Akana API Platform
    cvelistv5