Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS contain a time-of-check to time-of-use (TOCTOU) vulnerability that allows local privilege escalation. The GPA service creates an IPC socket in a world-writable /tmp directory and accepts unauthenticated IPC control messages. This enables an attacker to manipulate log files via symlinks to make root-owned files world-writable. Additionally, a diagnostic tool (gimmelogs) running as root is vulnerable to command injection on Linux/macOS, providing a second privilege escalation vector. The vulnerability affects GPA versions 7.0 through 7.3.1 and Zero Trust Client versions 6.0 through 6.1.5.