# CVE-2016-10157: Akamai NetSession DLL hijacking in CSUNSAPI.dll

Source: https://junglewise.ai/threats/cve-2016-10157-akamai-netsession-dll-hijacking-in-csunsapi-dll  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-10157 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Akamai NetSession, a software component used to speed up the download of large files and streams, contains a security flaw that allows for unauthorized code execution. By placing a malicious file in a specific location, an attacker can take control of the NetSession process. This could lead to a full compromise of the user's system, potentially allowing attackers to steal data or disrupt operations.

Vendors: [Akamai](https://junglewise.ai/threats/vendors/akamai).

## Quick answers

**Is CVE-2016-10157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-10157 being exploited in the wild.

**How severe is CVE-2016-10157?** Critical severity, with a CVSS score of 9.8, published 23 January 2017.

**Which products and versions are affected?** Akamai NetSession 1.9.3.1.

**Is there a fix for CVE-2016-10157?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-10157 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2016-10157?** Check whether you run Akamai Netsession. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Akamai NetSession 1.9.3.1 is vulnerable to DLL hijacking (CWE-94) due to an insecure search path when attempting to load the 'CSUNSAPI.dll' library. The application fails to provide a fully qualified path to the DLL, and because the file is missing from the default installation, the operating system searches through the standard search order. An attacker can place a malicious version of this DLL in a directory searched by the application to achieve arbitrary code execution within the context of the NetSession process. While the NVD classifies the attack vector as network, DLL hijacking typically requires a local presence or a remote file share to place the malicious library.

## Affected products

- Akamai NetSession 1.9.3.1

## Timeline

- 2017-01-23: advisory: NVD published the vulnerability details.

## References

- [http://www.securityfocus.com/bid/95995](http://www.securityfocus.com/bid/95995)
- [https://packetstormsecurity.com/files/140366/Akamai-NetSession-1.9.3.1-DLL-Hijacking.html](https://packetstormsecurity.com/files/140366/Akamai-NetSession-1.9.3.1-DLL-Hijacking.html)