CVE-2026-50218 is a high-severity vulnerability in Akamai Guardicore Platform Agent (GPA) versions before 7.4. The GPA client improperly validates JWT tokens used for seeding, allowing an attacker to inject arbitrary parameters via a spoofed JWT token. This can lead to unauthorized reconfiguration and full compromise of the application's functionality. The attack requires convincing a user to interact with a malicious link or knowledge of the IDP URL used by an enrolled client. A patch is available to address this issue.
CVE-2026-50217 is a use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent. It allows a local low-privileged user to cause a denial of service (system crash or BSOD) by sending an outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the IPv6 ICMP redirect policy is enabled. The vulnerability arises because a buffer containing the packet is freed but still passed to a downstream filter, with the size of the freed allocation attacker-controlled. Exploitation requires the non-default IPv6 ICMP capture/redirect policy to be active on the endpoint. A patch is available for affected versions.
CVE-2026-50216 is an integer underflow vulnerability in the DNS proxy component of the macOS NetworkExtension system extension used by Akamai Guardicore Platform Agent (GPA). When a UDP datagram shorter than 96 bytes with a specific initial value is processed, a size calculation underflows, leading to an allocation failure and an uncaught Objective-C exception that aborts the root system extension. This results in a denial of service condition. The vulnerability affects GPA versions from 0 up to but not including 7.4. A patch is available to address this issue.
CVE-2026-50215 is a use-after-free vulnerability in the Windows WFP packet-capture driver of Akamai Guardicore Platform Agent before version 7.4. It can be triggered by a local attacker with Administrator privileges sending a crafted IPv6 packet when an IPv6 proxy/redirect rule is active, causing an immediate system crash.
A local privilege escalation vulnerability exists in the Akamai Guardicore Platform Agent (GPA) before version 7.4 on macOS. The flaw is in the wapptunneld component, which improperly validates network interface names used in system command execution. An unprivileged local user who can rename network interfaces can inject malicious commands that execute with root privileges when a specific logout action is triggered. This vulnerability is identified as CVE-2026-46449 and has a CVSS score of 6.7 (medium severity).
Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the HandleSaveLogs() function of the GPA service, by creating a log file and manipulating it into a symlink that points to the targeted path; this can allow an unprivileged local user to make arbitrary root-owned files world-writable. In addition, a diagnostic collection tool (gimmelogs) running with root privileges was vulnerable to command injection from the dbstore, offering a second privilege escalation vector. (On Windows, gimmelogs does not have command injection but does allow writing a ZIP archive to an unintended location.) This affects Akamai Guardicore Platform Agent 7.0 through 7.3.1 and Akamai Zero Trust Client 6.0 through 6.1.5.
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by a local privilege escalation vulnerability. The service will attempt to read an OpenSSL configuration file from a non-existent location that standard Windows users have default write access to. This allows an unprivileged local user to create a crafted "openssl.cnf" file in that location and, by specifying the path to a custom DLL file in a custom OpenSSL engine definition, execute arbitrary commands with the privileges of the Guardicore Agent process. Since Guardicore Agent runs with SYSTEM privileges, this permits an unprivileged user to fully elevate privileges to SYSTEM level in this manner.
Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards.
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.