Read the docs
TI-2026-26641 Aliases CVE-2026-34354GHSA-54h8-vwcv-q5r9

Time-of-check time-of-use race condition in Akamai Guardicore Platform Agent

Priority LOW 34CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the HandleSaveLogs() function of the GPA service, by creating a log file and manipulating it into a symlink that points to the targeted path; this can allow an unprivileged local user to make arbitrary root-owned files world-writable. In addition, a diagnostic collection tool (gimmelogs) running with root privileges was vulnerable to command injection from the dbstore, offering a second privilege escalation vector. (On Windows, gimmelogs does not have command injection but does allow writing a ZIP archive to an unintended location.) This affects Akamai Guardicore Platform Agent 7.0 through 7.3.1 and Akamai Zero Trust Client 6.0 through 6.1.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AkamaiGuardicore Platform Agent7.0 – 7.3.1—No fix listedCNA
AkamaiZero Trust Client6.0 – 6.1.5—No fix listedCNA
  • Guardicore Platform Agent VendorAkamai Affected 7.0 – 7.3.1 Fixed in — No fix listed CNA
  • Zero Trust Client VendorAkamai Affected 6.0 – 6.1.5 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34354
  2. 2026-10-03 Alias added: GHSA-54h8-vwcv-q5r9

References

Other 1

  • TI-2025-31529 Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. CVSS 3.1MEDIUM 5.8
  • TI-2008-01698 CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6… CVSS 2.0HIGH 9.3
  • TI-2019-08229 Akamai CloudTest before 58.30 allows remote code execution. CVSS 3.0CRITICAL 9.8
  • TI-2019-13582 Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. CVSS 3.1CRITICAL 9.8
  • TI-2016-08233 Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll… CVSS 3.0CRITICAL 9.8
  • TI-2026-73755 Guardicore Platform Agent JWT flaw enables resource injection CVSS 3.1HIGH 8.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences