Is CVE-2026-50217 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50217 being exploited in the wild.

How severe is CVE-2026-50217?

Medium severity, with a CVSS score of 4.7, published 14 October 2026.

Which products and versions are affected?

Akamai Guardicore Platform Agent before 7.5.0-v54.1.0.

Is there a fix for CVE-2026-50217?

No fixed version is recorded yet. Disable or restrict the IPv6 ICMP capture/redirect policy on affected endpoints if IPv6 ICMP filtering is not required for your security posture. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50217 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-50217?

Check whether you run Akamai Guardicore Platform Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50217: Akamai Guardicore Platform Agent use-after-free in WFP callout driver

CVE-2026-50217 · Severity: medium · CVSS 4.7 · Published 2026-10-14

Akamai Guardicore Platform Agent is endpoint security software that monitors and controls network traffic on Windows systems. A flaw in its network filtering driver allows a local attacker with standard user privileges to crash the system by sending a specially crafted IPv6 packet, disrupting business operations on affected machines. Exploitation requires a non-default IPv6 ICMP policy to be enabled.

Technologies: Akamai Guardicore Platform Agent. Vendors: Akamai.

Quick answers

Is CVE-2026-50217 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50217 being exploited in the wild.
How severe is CVE-2026-50217?: Medium severity, with a CVSS score of 4.7, published 14 October 2026.
Which products and versions are affected?: Akamai Guardicore Platform Agent before 7.5.0-v54.1.0.
Is there a fix for CVE-2026-50217?: No fixed version is recorded yet. Disable or restrict the IPv6 ICMP capture/redirect policy on affected endpoints if IPv6 ICMP filtering is not required for your security posture. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50217 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-50217?: Check whether you run Akamai Guardicore Platform Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable or restrict the IPv6 ICMP capture/redirect policy on affected endpoints if IPv6 ICMP filtering is not required for your security posture.

Technical details

A use-after-free vulnerability exists in the Windows WFP (Windows Filtering Platform) callout driver when processing outbound ICMPv6 packets with IPv6 Hop-by-Hop extension headers while the IPv6 ICMP redirect policy is active. The driver copies the packet into a buffer that is subsequently freed but passed to downstream filters, and the attacker controls the buffer size via packet length, enabling kernel pool grooming attacks. Local low-privileged attack vector; results in denial of service via kernel crash.

Affected products

Akamai Guardicore Platform Agent before 7.5.0-v54.1.0

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.