Read the docs
TI-2025-34346 Aliases CVE-2025-54568GHSA-8pgc-2j25-rwg6

Akamai Rate Control alpha before 2025 allows attackers to send requests above the…

Priority LOW 18CWE-684Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Fix Fixed Rate Control (Akamai): 2025

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AkamaiRate Controlalpha to before 20252025Patch availableCNA
  • Rate Control VendorAkamai Affected alpha to before 2025 Fixed in 2025 Patch available CNA

Remediation

  • Fix · CNA Rate Control (Akamai) Fixed in 2025

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54568
  2. 2026-10-03 Alias added: GHSA-8pgc-2j25-rwg6

References

Other 2

  • TI-2025-31529 Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. CVSS 3.1MEDIUM 5.8
  • TI-2008-01698 CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6… CVSS 2.0HIGH 9.3
  • TI-2019-08229 Akamai CloudTest before 58.30 allows remote code execution. CVSS 3.0CRITICAL 9.8
  • TI-2019-13582 Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. CVSS 3.1CRITICAL 9.8
  • TI-2016-08233 Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll… CVSS 3.0CRITICAL 9.8
  • TI-2026-73755 Guardicore Platform Agent JWT flaw enables resource injection CVSS 3.1HIGH 8.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences