Log in Start free

Akamai

Products

ProductCVEsExploitedLatest
Guardicore Platform Agent7–Oct 14, 2026
CloudTest2–Jun 30, 2025
AkamaiGhost2–Aug 29, 2025
Ghost1–Feb 23, 2026
Rate Control1–Jul 25, 2025
Zero Trust Client1–May 8, 2026
App & API Protector1–Mar 17, 2025
Enterprise Application Access1–Jan 29, 2025

Exploited and recent CVEs

  • CVE-2026-46449 Medium 6.7 The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of inp 1.7%
  • CVE-2026-50215 Medium 4.4 A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Admin 0.1%
  • CVE-2026-50218 High 8.5 Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use 0.3%
  • CVE-2026-50217 Medium 4.7 A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an 0.1%
  • CVE-2026-50216 Medium 5.3 An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter t 0.3%
  • CVE-2026-34354 High 7.4 Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp director 0.3%
  • CVE-2026-34354 High 7.4 Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp director 0.3%
  • CVE-2026-26365 Medium 4.0 Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could 0.2%
  • CVE-2025-53841 High 7.8 The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by a local privilege escalation vulnerabilit 0.2%
  • CVE-2025-54142 Medium 4.0 Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akama 0.3%
  • CVE-2025-32094 Medium 4.0 An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" 0.6%
  • CVE-2025-54568 Low 3.7 Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node. 0.4%
  • CVE-2025-52491 Medium 5.8 Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. 0.3%
  • CVE-2025-49493 Medium 5.8 Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. 2.1%
  • CVE-2025-30143 Medium 5.4 Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to built-in functions and properties. 0.2%
  • CVE-2025-24527 High 8.0 An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can execute debug commands on that connector. 0.4%