# CVE-2026-50217: Akamai Guardicore Platform Agent use-after-free in WFP callout driver

Source: https://junglewise.ai/threats/cve-2026-50217-a-use-after-free-vulnerability-in-the-windows-wfp-callout-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-50217 · Severity: medium · CVSS 4.7 · Published 2026-10-14

Akamai Guardicore Platform Agent is endpoint security software that monitors and controls network traffic on Windows systems. A flaw in its network filtering driver allows a local attacker with standard user privileges to crash the system by sending a specially crafted IPv6 packet, disrupting business operations on affected machines. Exploitation requires a non-default IPv6 ICMP policy to be enabled.

Technologies: [Akamai Guardicore Platform Agent](https://junglewise.ai/threats/technologies/guardicore-platform-agent). Vendors: [Akamai](https://junglewise.ai/threats/vendors/akamai).

## Quick answers

**Is CVE-2026-50217 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50217 being exploited in the wild.

**How severe is CVE-2026-50217?** Medium severity, with a CVSS score of 4.7, published 14 October 2026.

**Which products and versions are affected?** Akamai Guardicore Platform Agent before 7.5.0-v54.1.0.

**Is there a fix for CVE-2026-50217?** No fixed version is recorded yet. Disable or restrict the IPv6 ICMP capture/redirect policy on affected endpoints if IPv6 ICMP filtering is not required for your security posture. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50217 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-50217?** Check whether you run Akamai Guardicore Platform Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable or restrict the IPv6 ICMP capture/redirect policy on affected endpoints if IPv6 ICMP filtering is not required for your security posture.

## Technical details

A use-after-free vulnerability exists in the Windows WFP (Windows Filtering Platform) callout driver when processing outbound ICMPv6 packets with IPv6 Hop-by-Hop extension headers while the IPv6 ICMP redirect policy is active. The driver copies the packet into a buffer that is subsequently freed but passed to downstream filters, and the attacker controls the buffer size via packet length, enabling kernel pool grooming attacks. Local low-privileged attack vector; results in denial of service via kernel crash.

## Affected products

- Akamai Guardicore Platform Agent before 7.5.0-v54.1.0

## Timeline

- 2026-10-14: disclosed

## References

- [https://techdocs.akamai.com/guardicore-platform-agent/changelog/](https://techdocs.akamai.com/guardicore-platform-agent/changelog/)
- [https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4](https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4)

## Related threats

- [Akamai Guardicore Platform Agent improper JWT validation](https://junglewise.ai/threats/cve-2026-50218-akamai-gpa-guardicore-platform-agent-client-on-all-platforms)
- [Akamai Guardicore Platform Agent integer underflow in DNS proxy](https://junglewise.ai/threats/cve-2026-50216-an-integer-underflow-exists-in-the-dns-proxy-component-of-the)
- [Akamai Guardicore Platform Agent use-after-free in WFP driver](https://junglewise.ai/threats/cve-2026-50215-a-use-after-free-exists-in-the-windows-wfp-packet-capture-driver)
- [Akamai Guardicore Platform Agent command injection in wapptunneld](https://junglewise.ai/threats/cve-2026-46449-the-akamai-guardicore-platform-agent-gpa-before-7-4-for-macos-is)
- [Akamai Guardicore Platform Agent local privilege escalation](https://junglewise.ai/threats/cve-2026-34354-akamai-guardicore-platform-agent-local-privilege-escalation)