Exposição de Akamai

CDN
26
score de exposição
28.971
sites usam
0
em exploração
0
críticos
Análise Vexday

Com apenas 10 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, a superfície de risco documentada do Akamai permanece reduzida em comparação com a média geral do catálogo. A ausência de vulnerabilidades de severidade crítica reforça esse perfil contido, embora uma CVE tenha surgido nos últimos 90 dias, indicando atividade recente no ciclo de descoberta. A falha mais comum é classificada como CWE-444 (inconsistência na interpretação de requisições HTTP), um tipo de fraqueza relevante em componentes de entrega e proxy de conteúdo, pois pode permitir contornar controles de segurança intermediários. A CVE mais perigosa atualmente identificada, CVE-2025-49493, apresenta EPSS de 0,034, sugerindo probabilidade de exploração ainda baixa no curto prazo, mas merece acompanhamento dado seu surgimento recente.

CVEs

15 resultados
CVE-2025-49493MEDIUMAkamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.EPSS 2.1%CVE-2026-46449MEDIUMThe Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunEPSS 1.7%CVE-2025-32094MEDIUMAn issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client makingEPSS 0.6%CVE-2025-54568LOWAkamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separatEPSS 0.4%CVE-2025-24527HIGHAn issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connectoEPSS 0.4%CVE-2025-52491MEDIUMAkamai CloudTest before 60 2025.06.09 (12989) allows SSRF.EPSS 0.3%CVE-2026-50218HIGHAkamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a EPSS 0.3%CVE-2026-34354HIGHAkamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA serviEPSS 0.3%CVE-2026-50216MEDIUMAn integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore PlatforEPSS 0.3%CVE-2025-54142MEDIUMAkamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequeEPSS 0.3%CVE-2025-30143MEDIUMRule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variEPSS 0.2%CVE-2026-26365MEDIUMAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming requestEPSS 0.2%CVE-2025-53841HIGHThe GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.EPSS 0.2%CVE-2026-50215MEDIUMA use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPvEPSS 0.1%CVE-2026-50217MEDIUMA use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged useEPSS 0.1%