Read the docs
TI-2026-73754 Aliases CVE-2026-50217GHSA-p8p9-vpf5-3ff3

Akamai Guardicore GPA Use-After-Free Denial of Service

Priority LOW 20CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

A use-after-free in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) lets a local low-privileged user crash the system (BSOD) by sending an outbound ICMPv6 packet with an IPv6 Hop-by-Hop extension header. The flaw (CWE-416) is in the IPv6 ICMP redirect path: when that policy is active, the packet is copied into a buffer that is freed and then passed to a downstream filter. The attacker controls the freed allocation's size through the packet length, enabling kernel pool grooming. Exploitation requires the non-default IPv6 ICMP capture/redirect policy to be enabled on the endpoint, and the CVSS 3.1 base score is 4.7 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00108 1st percentileScored 2026-11-07
Fix Fixed Guardicore Platform Agent (Akamai): 7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AkamaiGuardicore Platform Agentbefore 7.47.4Patch availableCNA
  • Guardicore Platform Agent VendorAkamai Affected before 7.4 Fixed in 7.4 Patch available CNA

Remediation

Upgrade Akamai Guardicore Platform Agent (GPA) to version 7.4 or later. Versions before 7.4 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Guardicore Platform Agent (Akamai) Fixed in 7.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Akamai Guardicore Platform Agent 7.4

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-73755 Guardicore Platform Agent JWT flaw enables resource injectionPriority LOW 39
    • TI-2026-73751 Command injection in Akamai Guardicore Platform Agent for macOSPriority LOW 35
    • TI-2026-73753 Integer underflow in Akamai Guardicore Platform Agent DNS proxyPriority LOW 30
    Show all 5 records →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-50217
  2. 2026-10-14 Alias added: GHSA-p8p9-vpf5-3ff3
  3. 2026-10-15 CISA SSVC decision points changed

References

Other 2

  • TI-2025-31529 Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. CVSS 3.1MEDIUM 5.8
  • TI-2008-01698 CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6… CVSS 2.0HIGH 9.3
  • TI-2019-08229 Akamai CloudTest before 58.30 allows remote code execution. CVSS 3.0CRITICAL 9.8
  • TI-2019-13582 Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. CVSS 3.1CRITICAL 9.8
  • TI-2016-08233 Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll… CVSS 3.0CRITICAL 9.8
  • TI-2026-73755 Guardicore Platform Agent JWT flaw enables resource injection CVSS 3.1HIGH 8.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences