Akamai
17 CVEs across 12 Akamai products. Browse Akamai vulnerabilities, severities, and proof-of-concept exploits.
Akamai products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34354 | High | 7.4 | 2026-05-08 | Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC s… |
CVE-2026-26365 | Medium | 4.0 | 2026-02-23 | Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the hea… |
CVE-2025-66373 | Medium | 4.8 | 2025-12-04 | Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Gh… |
CVE-2025-53841 | High | 7.8 | 2025-12-03 | The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by… |
CVE-2025-54142 | Medium | 4.0 | 2025-08-29 | Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within t… |
CVE-2025-32094 | Medium | 4.0 | 2025-08-07 | An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTION… |
CVE-2025-54568 | Low | 3.7 | 2025-07-25 | Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge n… |
CVE-2025-52491 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF. |
CVE-2025-49493 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. |
CVE-2025-30143 | Medium | 5.4 | 2025-03-17 | Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to… |
CVE-2025-24527 | High | 8.0 | 2025-01-29 | An issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connector GUID, they can ex… |
CVE-2024-45164 | High | 7.1 | 2024-11-04 | Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal befor… |
CVE-2021-40683 | High | 7.8 | 2021-10-04 | In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack… |
CVE-2019-18847 | Critical | 9.8 | 2020-08-26 | Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. |
CVE-2019-11011 | Critical | 9.8 | 2019-06-21 | Akamai CloudTest before 58.30 allows remote code execution. |
CVE-2016-10157 | Critical | 9.8 | 2017-01-23 | Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because th… |
CVE-2008-1770 | | 2008-06-04 | CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and execution of arbitrary… |