CVE-2026-50215

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in Akamai Guardicore Platform Agent

Publication date: 2026-10-14

Last updated on: 2026-10-17

Assigner: MITRE

Description

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger this at DISPATCH_LEVEL, resulting in an immediate system crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-50215

EUVD

EUVD-2026-100805

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free flaw in the Windows WFP packet-capture driver included with Akamai Guardicore Platform Agent (GPA) versions before 7.4. It occurs when an IPv6 proxy or redirect rule is active. A local attacker with Administrator privileges can exploit this by sending a single crafted outbound IPv6 packet through a raw IPV6_HDRINCL socket, triggering the flaw at DISPATCH_LEVEL and causing an immediate system crash.

Detection Guidance

This vulnerability requires local Administrator privileges and an active IPv6 proxy/redirect rule in Akamai Guardicore Platform Agent (GPA) before 7.4. Check GPA version with 'gpa --version' or inspect running services for GPA. Monitor system crashes or BSODs triggered by IPv6 packet handling.

Impact Analysis

This vulnerability allows a local attacker with Administrator privileges to crash the system by sending a specially crafted IPv6 packet. This results in a denial-of-service condition, causing the affected system to become unresponsive or reboot unexpectedly.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a local denial-of-service issue affecting system stability rather than data confidentiality or integrity. Compliance risks would only arise if the system crash leads to unavailability of critical services handling regulated data.

Mitigation Strategies

Upgrade Akamai Guardicore Platform Agent (GPA) to version 7.4 or later immediately. Disable IPv6 proxy/redirect rules if not required. Restrict local Administrator privileges to reduce attack surface. Apply Microsoft patches for WFP driver vulnerabilities if available.

Hi! I’m here to help you understand CVE-2026-50215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70