CVE-2026-46449: Local Privilege Escalation (macOS)
The Akamai Guardicore Platform Agent for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. A lack of input validation when processing network interface names allows an unprivileged local user able to change the name of a network interface to inject a malicious shell payload, leading to the execution of arbitrary commands with root privileges.
CVSS 3.1 Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (6.7 - Medium)
CVE-2026-50215: Use-After-Free (Windows)
A use-after-free vulnerability exists in the Windows WFP callout driver of the Akamai Guardicore Platform Agent. A local low-privileged user could potentially cause a system crash (denial of service) by sending an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. This requires the non-default IPv6 ICMP capture/redirect policy to be enabled.
CVSS 3.1 Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (4.4 - Medium)
CVE-2025-50216: Integer Underflow DoS (macOS)
The Akamai Guardicore Platform Agent for macOS is affected by an Integer Underflow vulnerability in the DNS proxy component of the macOS NetworkExtension system extension, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZE_MAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension.
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 - Medium)
CVE-2025-50217: Use-After-Free DoS (Windows)
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header.
When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.
CVSS 3.1 Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7 - Medium)
CVE-2026-50218: Guardicore Improper JWT Validation
A vulnerability involving improper JSON Web Token (JWT) validation has been identified. By convincing a user to interact with a malicious link or network request, a remote attacker can leverage a spoofed JWT token to inject arbitrary configuration parameters into the client software, potentially leading to a full compromise of the GPA client’s functionality.
CVSS 3.1 Vector: AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H (8.5 - High)
