CVE-2026-78632: medium-severity vulnerability in Okta RADIUS Agent
Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.1%
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Okta · Okta RADIUS AgentRelated CVEs — Okta RADIUS Agent
In the same product, most dangerous first.