THREATIST.IORead the docs No Akamai vulnerabilities are listed in CISA KEV.
22 records
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and execution of arbitrary files via a URL parameter containing an encoded LF followed…
Akamai CloudTest before 58.30 allows remote code execution.
Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path.
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.
An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17.
The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component.
The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by a local privilege escalation vulnerability.
Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation.
In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution.
Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF.
Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization co…
An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that be…
Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to built-in functions and properties.
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling.
A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 pack…
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26.
A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4.
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward…
Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.
Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and a…