CVE-2026-34354

Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the HandleSaveLogs() function of the GPA service, by creating a log file and manipulating it into a symlink that points to the targeted path; this can allow an unprivileged local user to make arbitrary root-owned files world-writable. In addition, a diagnostic collection tool (gimmelogs) running with root privileges was vulnerable to command injection from the dbstore, offering a second privilege escalation vector. (On Windows, gimmelogs does not have command injection but does allow writing a ZIP archive to an unintended location.) This affects Akamai Guardicore Platform Agent 7.0 through 7.3.1 and Akamai Zero Trust Client 6.0 through 6.1.5.

• CWE-367

• https://www.akamai.com/blog/security-research/advisory-cve-2026-34354-guardicore-local-privilege-escalation

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34348Protection mechanism failure in Windows Event Logging Servic…6.5
• CVE-2026-34349Exposure of sensitive information to an unauthorized actor i…5.5
• CVE-2026-34350Null pointer dereference in Windows Storport Miniport Driver…6.5
• CVE-2026-34351Concurrent execution using shared resource with improper syn…7
• CVE-2026-34352In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows o…9.8
• CVE-2026-34353In OCaml through 4.14.3, Bigarray.reshape allows an integer …5.1
• CVE-2026-34355A buffer overflow in mod_proxy_html in Apache HTTP Server 2.…7.5
• CVE-2026-34356Heap-based Buffer Overflow vulnerability in Apache HTTP Serv…7.5
• CVE-2026-34358CtrlPanel is open-source billing software for hosting provid…8.1
• CVE-2026-34359HAPI FHIR is a complete implementation of the HL7 FHIR stand…9.1
• CVE-2026-34360HAPI FHIR is a complete implementation of the HL7 FHIR stand…5.8
• CVE-2026-34361HAPI FHIR is a complete implementation of the HL7 FHIR stand…9.3