CVE-2026-50217

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.

• CWE-416

• https://techdocs.akamai.com/guardicore-platform-agent/changelog/
• https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4

Published

Oct 14, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50211Leftover engineering diagnostics and factory-level diagnosti…9.8
• CVE-2026-50212Weak validation logic within device dissociation API routine…6.5
• CVE-2026-50213The account validation endpoint /v1/User/validate returns co…7.5
• CVE-2026-50214The /v1/Plan service relies entirely on a shared global API …9.8
• CVE-2026-50215A use-after-free exists in the Windows WFP packet-capture dr…4.4
• CVE-2026-50216An integer underflow exists in the DNS proxy component of th…5.3
• CVE-2026-50218Akamai GPA (Guardicore Platform Agent) client on all platfor…8.5
• CVE-2026-50219libexpat before 2.8.2 lacks handler call depth tracking for …5.9
• CVE-2026-5022The '/api/v1/files/images/{flow_id}/{file_name}' endpoint do…5.3
• CVE-2026-50221In OpenStack Swift before 2.37.2, proxy-server does not stri…5.4
• CVE-2026-50222Missing Authorization, Exposure of Sensitive Information to …7.5
• CVE-2026-50223Improper Control of Generation of Code ('Code Injection') vu…8.8