# CVE-2026-46449

> CVE-2026-46449. CVSS 6.7 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-46449
Last updated: 2026-10-16T19:55:59Z

- Published: 2026-10-14 00:00 UTC · Updated: 2026-10-16 19:55 UTC · Assigner: mitre
- CVSS: 6.7 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS: 1.7%, 77th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-78

## Description

The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting in command injection. An unprivileged local user with permissions to modify network interface names can exploit this by renaming a network interface to include a malicious shell payload via System Settings. When the "Log out from your IdP" action is subsequently triggered, the wapptunneld service processes the poisoned interface name, leading to the execution of arbitrary commands with root privileges.

## Affected vendors and products

- Akamai: Guardicore Platform Agent

## Tracked companies

- [Akamai](https://rewindex.com/company/akamai.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-46449)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-46449)
- [https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4](https://www.akamai.com/newsroom/security-advisories/guardicore-platform-agent-7-4)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-46449 · Markdown: https://rewindex.com/cve/CVE-2026-46449.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-46449 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:09:50.825Z