Akamai Guardicore Platform Agent: Improper JWT validation allows configuration injection
Summary
The Akamai Guardicore Platform Agent (GPA) client before version 7.4 does not properly validate JWT tokens used for seeding. An attacker who convinces a user to interact with a malicious link can use a spoofed JWT to inject arbitrary parameters, which can lead to unauthorized reconfiguration and full compromise of the agent's functionality. An already enrolled client can also be targeted if the attacker knows the URL of the identity provider used for enrollment.
Affected
- Akamai Guardicore Platform Agent (GPA), all platforms, versions before 7.4
- CVSS 3.1: 8.5 (HIGH), CWE-99
Fixed in
- Upgrade to version 7.4 or later; the vendor fixed the issue in the 7.4.0-v53.5 release (June 12, 2026)
- Later 7.4 releases: 7.4.1-v53.6.1 (July 23, 2026) and 7.4.2-v53.6.1 (August 20, 2026, general availability)
- Status of 7.4.0 general availability and of 7.5.0 (October 12, 2026, limited availability) is unconfirmed; verify in the changelog before deploying
- The fix is released together with four other CVEs: CVE-2026-46449, CVE-2026-50215, CVE-2026-50216, CVE-2026-50217
Workaround
Unknown. The vendor has published no workaround; the advisory only directs customers to upgrade.
Exploitation
- No reports of exploitation in the wild as of the sources reviewed; CISA KEV listing: no
- No public proof of concept or exploit code found
- EPSS was 0.00328 at the time of the aggregator snapshot
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Check your inventory for Akamai Guardicore Platform Agent or Akamai Zero Trust Client deployments
- Upgrade all affected agents to 7.4.2 or the current recommended version shown in Enterprise Center, together with the other four CVEs of the same release
- Prioritise managed endpoints that enrol through an external identity provider
- Until patched, train users to treat unexpected GPA enrollment or configuration prompts and links with suspicion
- Restrict and monitor agent enrollment and identity provider settings in Enterprise Center
- Monitor for unexpected configuration changes on endpoints
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Akamai Security Advisory: Guardicore Platform Agent 7.4 www.akamai.com
- Akamai GPA Changelog techdocs.akamai.com
- Akamai GPA Release notes 7.4.0 (limited availability) techdocs.akamai.com
- Akamai GPA Release notes 7.4.2 (general availability) techdocs.akamai.com
- Akamai GPA Rollout process techdocs.akamai.com
- NVD record via Vulners (aggregator) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:40.
Original description (NVD)
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.