CVE-2026-46449: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Akamai Guardicore Platform Agent

CVE-2026-46449 is a local privilege escalation vulnerability in the Akamai Guardicore Platform Agent (GPA) prior to version 7.4 on macOS. The vulnerability arises from improper neutralization of special elements (CWE-78) in the wapptunneld component, which uses network interface names without sufficient input validation when executing system utilities. An unprivileged local user with the ability to rename network interfaces can inject shell commands by crafting malicious interface names. When the "Log out from your IdP" action is performed, the wapptunneld service processes these names and executes the injected commands with root privileges, leading to arbitrary command execution.

Successful exploitation allows an unprivileged local user to escalate privileges to root by injecting arbitrary commands via network interface names. This can compromise system integrity, confidentiality, and availability. The CVSS v3.1 base score is 6.7 (medium severity), reflecting local attack vector, low complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

A patch is available for Akamai Guardicore Platform Agent version 7.4 and later that addresses this vulnerability. Users should upgrade to version 7.4 or later to remediate the issue. Since the vulnerability requires local access and specific user permissions, limiting local user privileges and monitoring for unusual interface name changes can reduce risk until patched.