CVE-2026-46449 in Guardicore Platform Agent
Summary
by MITRE • 10/14/2026
The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting in command injection. An unprivileged local user with permissions to modify network interface names can exploit this by renaming a network interface to include a malicious shell payload via System Settings. When the "Log out from your IdP" action is subsequently triggered, the wapptunneld service processes the poisoned interface name, leading to the execution of arbitrary commands with root privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The Akamai Guardicore Platform Agent for macOS contains a critical local privilege escalation vulnerability within its wapptunneld component in versions prior to 7.4. This flaw stems from an insufficient validation mechanism when the service processes network interface names to execute system utilities. The architectural design assumes that input derived from operating system settings is inherently safe, failing to sanitize or validate these strings before passing them to shell commands. Consequently, this oversight creates a command injection vector that allows attackers with local access to escalate their privileges significantly beyond what was originally granted.
An unprivileged local user can exploit this vulnerability by manipulating the network interface configuration through System Settings. By renaming an existing network interface to include malicious shell payloads within its name string, the attacker prepares the environment for exploitation. The trigger mechanism is tied to specific administrative actions performed on the platform agent. Specifically, when a user initiates the Log out from your IdP action, the wapptunneld service processes the current state of network interfaces. During this process, it retrieves the interface names and passes them directly into system utility commands without adequate filtering or escaping of special characters.
The operational impact of this vulnerability is severe, as successful exploitation results in arbitrary command execution with root privileges. Since the vulnerable component runs with elevated permissions to manage secure tunneling connections, any code injected via the network interface name executes under these high-privilege contexts. This allows an attacker to bypass standard macOS security controls, install persistent backdoors, exfiltrate sensitive data, or further compromise other systems on the local network. The attack requires only local access and does not necessitate physical presence if remote desktop services are enabled, making it a significant risk in multi-user environments such as corporate workstations or shared development machines.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as Operating System Command Injection. The attack vector is classified under ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging shell commands to execute arbitrary code. Furthermore, the privilege escalation aspect corresponds to CWE-269 Improvement Control of Privilege Escalation Mitigation Failures or more accurately CWE-732 Incorrect Permission Assignment for Critical Resource if viewed through the lens of configuration management failures that allow unprivileged users to modify critical system parameters like network interface names in a way that impacts privileged services.
To mitigate this risk, organizations must immediately update the Akamai Guardicore Platform Agent on all macOS endpoints to version 7.4 or later where these input validation checks have been implemented. Administrators should also enforce strict policies regarding local user permissions and monitor for unusual modifications to network interface configurations using endpoint detection and response tools. Additionally, implementing principle of least privilege by restricting which users can modify system-level settings like network interfaces can reduce the attack surface even if software updates are delayed. Regular auditing of running processes spawned by privileged services such as wapptunneld can also help in detecting potential exploitation attempts in real time.