Akamai
Monthly
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Local privilege escalation in Akamai Guardicore Platform Agent 7.0-7.3.1 and Zero Trust Client 6.0-6.1.5 on Linux and macOS enables unprivileged users to gain root access through two distinct vectors: a TOCTOU race condition in the HandleSaveLogs() function that creates world-writable root-owned files via symlink manipulation in /tmp, and command injection in the gimmelogs diagnostic tool executing with root privileges. The vulnerability requires local access with high attack complexity (CVSS AC:H) but no authentication (PR:N), affecting endpoint security agents that typically run with elevated privileges. No active exploitation confirmed at time of analysis; EPSS data not available for this 2026 CVE identifier.
Local privilege escalation in Akamai Guardicore Platform Agent (GPA) on macOS before version 7.4 allows an attacker with administrative privileges to execute arbitrary commands as root by exploiting a command injection in the wapptunneld component. The vulnerability requires local access and high privileges (PR:H), and exploitation necessitates that the 'Log out from your IdP' action is triggered after a malicious network interface name is set. No public exploit code or active exploitation has been identified; this is a genuine but bounded risk limited to unpatched macOS deployments.
Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform Agent by sending a crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the non-default IPv6 ICMP redirect policy is enabled. This use-after-free (CWE-416) in the WFP callout driver allows kernel pool grooming, leading to a system crash. The vulnerability requires local access (AV:L) and high attack complexity (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Akamai CloudTest before 58.30 allows remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Local privilege escalation in Akamai Guardicore Platform Agent 7.0-7.3.1 and Zero Trust Client 6.0-6.1.5 on Linux and macOS enables unprivileged users to gain root access through two distinct vectors: a TOCTOU race condition in the HandleSaveLogs() function that creates world-writable root-owned files via symlink manipulation in /tmp, and command injection in the gimmelogs diagnostic tool executing with root privileges. The vulnerability requires local access with high attack complexity (CVSS AC:H) but no authentication (PR:N), affecting endpoint security agents that typically run with elevated privileges. No active exploitation confirmed at time of analysis; EPSS data not available for this 2026 CVE identifier.
Local privilege escalation in Akamai Guardicore Platform Agent (GPA) on macOS before version 7.4 allows an attacker with administrative privileges to execute arbitrary commands as root by exploiting a command injection in the wapptunneld component. The vulnerability requires local access and high privileges (PR:H), and exploitation necessitates that the 'Log out from your IdP' action is triggered after a malicious network interface name is set. No public exploit code or active exploitation has been identified; this is a genuine but bounded risk limited to unpatched macOS deployments.
Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform Agent by sending a crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the non-default IPv6 ICMP redirect policy is enabled. This use-after-free (CWE-416) in the WFP callout driver allows kernel pool grooming, leading to a system crash. The vulnerability requires local access (AV:L) and high attack complexity (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Akamai CloudTest before 58.30 allows remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.