Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

akamai-security-research

Akamai Security Research This repository includes code and IoCs that are the product of research done in Akamai's various security research teams. You can read about our research in Akamai's Security blog. Copyright 2024 Akamai Technologies Inc. Licensed under the Apache License, Version 2.0 the...

FREAK-Attack-CVE-2015-0204-Testing-Script

FREAK Attack CVE 20150204 Testing Script Basic BASH Script to Automate OpenSSL based testing for FREAK Attack CVE-2015-0204 as advised by Akamai. It is a Free Software and does not need other's server to run. Your server must score A+ to SSL Labs test under normal situation, should listed as HSTS...

CVE-2025-49493

Akamai CloudTest XXE Exploit CVE-2025-49493 Overview This is a Python-based exploit for CVE-2025-49493 , which affects Akamai CloudTest versions before 60 2025.06.02 12988. The vulnerability allows for XML External Entity XXE injection through the SOAP service endpoint. Vulnerability Details CVE ...

CVE-2026-50217

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent GPA allows a local low-privileged user to cause a denial of service system crash / BSOD via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect...

CVE-2026-50216

An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent GPA for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflow...

CVE-2026-50218

Akamai GPA Guardicore Platform Agent client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in...

CVE-2026-50215

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

CVE-2026-46449

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

PT-2026-113651

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent GPA allows a local low-privileged user to cause a denial of service system crash / BSOD via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect...

PT-2026-113648

The Akamai Guardicore Platform Agent GPA before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting ...

CVE-2026-50217: Use After Free

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent GPA allows a local low-privileged user to cause a denial of service system crash / BSOD via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect...

CVE-2026-50217

A use-after-free vulnerability exists in the Windows WFP callout driver of the Akamai Guardicore Platform Agent (GPA) . A local low-privileged user can trigger a denial of service (system crash / BSOD) by sending an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. The flaw o...

CVE-2026-50216

An integer underflow vulnerability exists in the DNS proxy component of the macOS NetworkExtension system extension within the Akamai Guardicore Platform Agent (GPA) for macOS . If the agent receives a UDP datagram shorter than 96 bytes starting with a specific value, a size computation underflow...

CVE-2026-46449

The Akamai Guardicore Platform Agent (GPA) for macOS versions prior to 7.4 is vulnerable to a local privilege escalation via a command injection flaw in the wapptunneld component. The root cause is a lack of input validation when the service uses network interface names to execute system utilitie...

CVE-2026-50215

The Akamai Guardicore Platform Agent (GPA) shipped before version 7.4 contains a use-after-free vulnerability in the Windows WFP packet-capture driver. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can trigger this flaw at DISPATCH_LEVEL by sending a s...

EUVD-2026-100834

Akamai GPA Guardicore Platform Agent client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in...

EUVD-2026-100833

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent GPA allows a local low-privileged user to cause a denial of service system crash / BSOD via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect...

EUVD-2026-100832

An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent GPA for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflow...

CVE-2026-50216: Integer Underflow (Wrap or Wraparound)

An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent GPA for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflow...