Guardicore Platform Agent CVE-2026-50215

Exploitation requires a specific non-default precondition stated in the description: an IPv6 proxy/redirect rule must be active in the Guardicore Platform Agent. The attacker must also already hold local Administrator privileges on the host (consistent with PR:H) and must craft and send an outbound IPv6 packet through a raw IPV6_HDRINCL socket - an operation that itself typically demands elevated rights on Windows. Limiting factors that reduce realistic risk: the agent version must be before 7.4; the IPv6 redirect/proxy feature must be enabled (hosts without it are not affected); and because the attacker must be a local Administrator, the flaw grants no privilege gain - only a denial-of-service crash. No user interaction is required once those conditions are met.

All signals point to this being a LOW real-world priority despite being a memory-corruption (use-after-free) flaw. The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H = 4.4 Medium) is internally consistent with the description: exploitation is local (the attacker must open a raw IPV6_HDRINCL socket on the host) and requires PR:H - the description explicitly states Administrator privileges are needed. Impact is confined to availability (A:H) with no confidentiality or integrity effect; the outcome is an immediate system crash (DoS), not code execution or privilege escalation. Critically, an attacker who already holds local Administrator rights can crash or halt a Windows host through many other means, so this adds little practical capability beyond what the required privilege level already grants. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The one caveat: the CWE-416 use-after-free occurs at DISPATCH_LEVEL in a kernel-mode driver, which in some UAF cases can be developed beyond a crash into code execution - but nothing in the supplied data indicates that is achievable here, and the official impact is availability-only. Treat as a routine patch item, not an emergency.

A local attacker who has already obtained Administrator privileges on a Windows host running Akamai Guardicore Platform Agent (before 7.4) with an IPv6 proxy/redirect rule active opens a raw IPV6_HDRINCL socket and sends a single crafted outbound IPv6 packet. The malformed packet triggers a use-after-free in the WFP packet-capture driver at DISPATCH_LEVEL, bugchecking the kernel and crashing the entire system. No public exploit code was identified in the provided data.