Guardicore Platform Agent
Monthly
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Local privilege escalation in Akamai Guardicore Platform Agent (GPA) on macOS before version 7.4 allows an attacker with administrative privileges to execute arbitrary commands as root by exploiting a command injection in the wapptunneld component. The vulnerability requires local access and high privileges (PR:H), and exploitation necessitates that the 'Log out from your IdP' action is triggered after a malicious network interface name is set. No public exploit code or active exploitation has been identified; this is a genuine but bounded risk limited to unpatched macOS deployments.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform Agent by sending a crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the non-default IPv6 ICMP redirect policy is enabled. This use-after-free (CWE-416) in the WFP callout driver allows kernel pool grooming, leading to a system crash. The vulnerability requires local access (AV:L) and high attack complexity (AC:H); no public exploit code or active exploitation has been identified at time of analysis.
Improper validation of the JWT seeding token used by Akamai's Guardicore Platform Agent (GPA) client before version 7.4 allows an attacker who persuades a user to interact with a crafted link to slip a spoofed token into the enrollment flow and inject arbitrary configuration parameters, reconfiguring the agent and compromising its functionality end to end. The same spoofed-token technique can be aimed at an already-seeded client, but only when the attacker also knows the specific identity-provider (IDP) URL that client used for enrollment, a concrete prerequisite that constrains opportunistic targeting. There is no public exploit code identified at time of analysis and the issue is not in CISA's KEV catalog; Akamai has released 7.4 as the corrected version, and the independent assessment rates the flaw CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - serious, but not an immediate drop-everything emergency on current signals.
Local privilege escalation in Akamai Guardicore Platform Agent (GPA) on macOS before version 7.4 allows an attacker with administrative privileges to execute arbitrary commands as root by exploiting a command injection in the wapptunneld component. The vulnerability requires local access and high privileges (PR:H), and exploitation necessitates that the 'Log out from your IdP' action is triggered after a malicious network interface name is set. No public exploit code or active exploitation has been identified; this is a genuine but bounded risk limited to unpatched macOS deployments.
A malformed UDP packet can abort the DNS proxy running inside the Akamai Guardicore Platform Agent's macOS NetworkExtension system extension, which executes as a root-level system extension, producing an availability loss on the host. Specifically, a single UDP datagram shorter than 96 bytes that begins with a particular trigger value drives an integer underflow (CWE-191) in a length/size calculation, causing a near-SIZE_MAX allocation request that fails and raises an uncaught Objective-C exception, terminating the extension. The CVSS 3.1 vector (5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) rates this as a low-impact, unauthenticated network availability issue with no confidentiality or integrity effect, and the independent assessment characterises it as a genuine but bounded problem whose real-world reachability depends on whether the DNS proxy listener actually consumes arbitrarily sourced packets or only on-device queries and upstream responses; no public exploit code and no CISA KEV entry were identified at the time of analysis, and no EPSS score was supplied in the source data.
Local, low-privileged users can cause a denial-of-service (BSOD) on Windows endpoints running Akamai Guardicore Platform Agent by sending a crafted outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header when the non-default IPv6 ICMP redirect policy is enabled. This use-after-free (CWE-416) in the WFP callout driver allows kernel pool grooming, leading to a system crash. The vulnerability requires local access (AV:L) and high attack complexity (AC:H); no public exploit code or active exploitation has been identified at time of analysis.