Guardicore Platform Agent CVE-2026-46449

Requires: (1) the Akamai Guardicore Platform Agent before version 7.4 installed on macOS; (2) a local account with permission to rename network interfaces via System Settings, which on macOS entails administrative privileges (matching the published PR:H); and (3) the vulnerable wapptunneld service plus a configured IdP so that the 'Log out from your IdP' action can be triggered to process the poisoned interface name. Limiting factors: exploitation is local-only (no network vector), the attacker must already hold admin-level local access, the specific IdP-logout action must subsequently fire to reach the vulnerable code path, and only macOS deployments below 7.4 are affected - upgrading to 7.4 or later removes the flaw.

This is a genuine but bounded risk. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7 MEDIUM) describes a local privilege-escalation flaw requiring high privileges already on the host, not a remotely reachable issue - so it is not a mass-exploitation candidate. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood signals are entirely absent: no public exploit identified at time of analysis and no evidence of active exploitation. The practical severity is the full compromise of a single endpoint: successful exploitation yields arbitrary command execution as root (C:H/I:H/A:H on a security agent), which is high technical impact locally but does not cross a trust boundary to other systems (S:U). Note a tension worth verifying with the vendor: the description calls the actor an 'unprivileged local user with permissions to modify network interface names,' yet renaming a network interface via macOS System Settings normally requires administrative rights, which aligns with the PR:H in the published vector - the 'unprivileged' wording appears to mean 'non-root' rather than truly unprivileged, so the real prerequisite is a local admin (not root) account. Overall this is a legitimate hardening priority for macOS fleets running Guardicore, but not an emergency relative to network-exploitable criticals.

A local user holding macOS admin rights (but not root) on a host running Guardicore Platform Agent before 7.4 renames a network interface via System Settings, embedding a shell command payload in the interface name. When the 'Log out from your IdP' action is later triggered, the root-level wapptunneld service passes the attacker-controlled interface name unvalidated into a system utility invocation, executing the injected command as root. No public proof-of-concept was provided in the input.