# CVE-2026-50215: Akamai Guardicore Platform Agent use-after-free in WFP driver

Source: https://junglewise.ai/threats/cve-2026-50215-a-use-after-free-exists-in-the-windows-wfp-packet-capture-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-50215 · Severity: medium · CVSS 4.4 · Published 2026-10-14

Akamai Guardicore Platform Agent is a network security tool that monitors and controls traffic on Windows systems. A use-after-free vulnerability in its Windows WFP packet-capture driver allows a local administrator to crash the system by sending a specially crafted IPv6 packet, causing an immediate denial of service.

Technologies: [Akamai Guardicore Platform Agent](https://junglewise.ai/threats/technologies/guardicore-platform-agent). Vendors: [Akamai](https://junglewise.ai/threats/vendors/akamai).

## Quick answers

**Is CVE-2026-50215 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50215 being exploited in the wild.

**How severe is CVE-2026-50215?** Medium severity, with a CVSS score of 4.4, published 14 October 2026.

**Which products and versions are affected?** Akamai Guardicore Platform Agent before 7.4.

**Is there a fix for CVE-2026-50215?** Yes: fixed in 7.4 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50215 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-50215?** Check whether you run Akamai Guardicore Platform Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.4 and later

## Technical details

A use-after-free exists in the WFP packet-capture driver when an IPv6 proxy/redirect rule is active. A local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger the vulnerability at DISPATCH_LEVEL, resulting in a kernel crash. The vulnerability requires administrator-level access and an active IPv6 proxy configuration.

## Affected products

- Akamai Guardicore Platform Agent before 7.4

## Timeline

- 2026-10-14: disclosed

## References

- [https://techdocs.akamai.com/guardicore-platform-agent/changelog/](https://techdocs.akamai.com/guardicore-platform-agent/changelog/)
- [https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4](https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4)

## Related threats

- [Akamai Guardicore Platform Agent improper JWT validation](https://junglewise.ai/threats/cve-2026-50218-akamai-gpa-guardicore-platform-agent-client-on-all-platforms)
- [Akamai Guardicore Platform Agent use-after-free in WFP callout driver](https://junglewise.ai/threats/cve-2026-50217-a-use-after-free-vulnerability-in-the-windows-wfp-callout-driver)
- [Akamai Guardicore Platform Agent integer underflow in DNS proxy](https://junglewise.ai/threats/cve-2026-50216-an-integer-underflow-exists-in-the-dns-proxy-component-of-the)
- [Akamai Guardicore Platform Agent command injection in wapptunneld](https://junglewise.ai/threats/cve-2026-46449-the-akamai-guardicore-platform-agent-gpa-before-7-4-for-macos-is)
- [Akamai Guardicore Platform Agent local privilege escalation](https://junglewise.ai/threats/cve-2026-34354-akamai-guardicore-platform-agent-local-privilege-escalation)