CVE-2026-50218
CVSS Score
8.5
EPSS Score
0.0%
EPSS Percentile
0th
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
| CWE | CWE-99 |
| Vendor | akamai |
| Product | guardicore platform agent |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for akamai guardicore platform agent
Be the first to know when new high vulnerabilities affecting akamai guardicore platform agent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Akamai / Guardicore Platform Agent
0 < 7.4