Read the docs
TI-2026-73755 Aliases CVE-2026-50218GHSA-jpj7-7jv5-rp9j

Guardicore Platform Agent JWT flaw enables resource injection

Priority LOW 39CWE-99Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client, resulting in unauthorized reconfiguration and full compromise of the application's functionality. The attack can also target an already seeded client if the attacker knows the URL of the identity provider used for enrollment.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Fix Fixed Guardicore Platform Agent (Akamai): 7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AkamaiGuardicore Platform Agentbefore 7.47.4Patch availableCNA
  • Guardicore Platform Agent VendorAkamai Affected before 7.4 Fixed in 7.4 Patch available CNA

Remediation

Upgrade Akamai Guardicore Platform Agent to version 7.4 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Guardicore Platform Agent (Akamai) Fixed in 7.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Akamai Guardicore Platform Agent 7.4

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-73751 Command injection in Akamai Guardicore Platform Agent for macOSPriority LOW 35
    • TI-2026-73753 Integer underflow in Akamai Guardicore Platform Agent DNS proxyPriority LOW 30
    • TI-2026-73754 Akamai Guardicore GPA Use-After-Free Denial of ServicePriority LOW 20
    Show all 5 records →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-50218
  2. 2026-10-14 Alias added: GHSA-jpj7-7jv5-rp9j
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-19 CISA SSVC decision points changed

References

Other 2

  • TI-2025-31529 Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. CVSS 3.1MEDIUM 5.8
  • TI-2008-01698 CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6… CVSS 2.0HIGH 9.3
  • TI-2019-08229 Akamai CloudTest before 58.30 allows remote code execution. CVSS 3.0CRITICAL 9.8
  • TI-2019-13582 Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. CVSS 3.1CRITICAL 9.8
  • TI-2016-08233 Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll… CVSS 3.0CRITICAL 9.8
  • TI-2025-18244 Incorrect permission assignment in Akamai Enterprise Application Access CVSS 3.1HIGH 8.0
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences