The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows…
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-829.
Summary
The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by a local privilege escalation vulnerability. The service will attempt to read an OpenSSL configuration file from a non-existent location that standard Windows users have default write access to. This allows an unprivileged local user to create a crafted "openssl.cnf" file in that location and, by specifying the path to a custom DLL file in a custom OpenSSL engine definition, execute arbitrary commands with the privileges of the Guardicore Agent process. Since Guardicore Agent runs with SYSTEM privileges, this permits an unprivileged user to fully elevate privileges to SYSTEM level in this manner.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Akamai | Guardicore Platform Agent | before 50.15.0; 51 to before 51.12.0; 52 to before 52.1.1 | 50.15.0, 51.12.0, 52.1.1 | Patch available | CNA |
- Guardicore Platform Agent VendorAkamai Affected before 50.15.0; 51 to before 51.12.0; 52 to before 52.1.1 Fixed in 50.15.0, 51.12.0, 52.1.1 Patch available CNA
Remediation
- Fix · CNA Guardicore Platform Agent (Akamai) Fixed in 50.15.0, 51.12.0, 52.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53841
- 2026-10-03 Alias added: GHSA-2jmq-pwpx-v2pq
References
Other 4
- https://www.tuv.com/landingpage/en/vulnerability-disclosure/
- https://techdocs.akamai.com/guardicore-platform-agent/changelog
- https://community.akamai.com/customers/s/article/Windows-Agent-Vulnerability-Summary-and-Resolution
- https://www.akamai.com/blog/security/advisory-cve-2025-53841-guardicore-local-privilege-escalation
More Akamai vulnerabilities
- TI-2025-31529 Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. CVSS 3.1MEDIUM 5.8
- TI-2008-01698 CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6… CVSS 2.0HIGH 9.3
- TI-2019-08229 Akamai CloudTest before 58.30 allows remote code execution. CVSS 3.0CRITICAL 9.8
- TI-2019-13582 Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. CVSS 3.1CRITICAL 9.8
- TI-2016-08233 Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll… CVSS 3.0CRITICAL 9.8
- TI-2026-73755 Guardicore Platform Agent JWT flaw enables resource injection CVSS 3.1HIGH 8.5
Sources
- CVE-2025-53841 · CVE Program
- CVE-2025-53841 · NVD
- FIRST EPSS
- GHSA-2jmq-pwpx-v2pq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences