CVE-2026-34354: Guardicore Local Privilege Escalation Vulnerability

Akamai has mitigated a local privilege escalation vulnerability in Akamai Guardicore Platform Agent for macOS and Linux. Updated versions containing a fix for this vulnerability have been available since the beginning of April 2026 to all customers using Akamai Guardicore Platform Agent, and we strongly encourage all users to upgrade (if they have not yet done so).

Akamai Guardicore Platform Agent and Akamai Zero Trust Client on Linux and macOS are affected by a local privilege escalation vulnerability. The underlying services create an IPC socket in the world-writable /tmp directory, which accepts unauthenticated IPC control messages. 

This enables a TOCTOU vulnerability in the HandleSaveLogs() function of the service, by creating a log file and manipulating it into a symlink that points to the targeted path, which can allow an unprivileged local user to make arbitrary root-owned files world-writable. 

In addition, a diagnostic collection tool (gimmelogs) running with root privileges was vulnerable to command injection from the dbstore, offering a second privilege escalation vector.

On Windows, the same command injection vulnerability vector exists, but it is not immediately exploitable. This issue, however, does allow the creation of a diagnostic zip file at an arbitrary location.

This attack vector could only be exploited by a user with local access to the workstation or server; it is not remotely exploitable.

The vulnerability has been assigned CVE-2026-34354.

To mitigate the security risks, macOS or Linux customers are required to upgrade their clients following our online documentation or reach out to us via the Akamai Control Center Portal with any questions. (Note: The steps for installing the Akamai Zero Trust Client are the same). 

Customers using Windows clients are not at immediate risk and can perform the upgrade during their regular maintenance schedule to benefit from improved security hardening and file system protections.

This vulnerability was discovered internally by Rajesh Sharma.