What’s Vulnerable › Vulnerabilities

CVE-2021-40683

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-04 · updated 2026-06-17
• Weakness: CWE-428

Description

In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution.

Affected products

• Akamai Enterprise Application Access: before 2.3.1; from 2.4.0 before 2.4.1; from 2.5.0 before 2.5.3 — fixed in 2.3.1, 2.4.1, 2.5.3

How to fix

Upgrade to a fixed version: Akamai Enterprise Application Access 2.3.1, 2.4.1, 2.5.3. Check the vendor advisory for mitigations.

References

• https://akamai.com/blog/news/eaa-client-escalation-of-privilege-vulnerability
• https://www.akamai.com/products/enterprise-application-access
• https://akamai.com/blog/news/eaa-client-escalation-of-privilege-vulnerability
• https://www.akamai.com/products/enterprise-application-access

Get alerted when CVE-2021-40683 or the next vulnerability affects your stack