CVE-2026-78632

Awaiting Analysis Awaiting Analysis - Queue

Okta RADIUS Agent Windows Installer Privilege Escalation

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Okta

Description

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78632

EUVD

EUVD-2026-100484

Affected Vendors & Products

Vendor	Product	Version / Range
Okta	Okta	RADIUS Agent 2.17.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

The Okta RADIUS Agent Windows installer incorrectly sets write permissions on directories containing the agent configuration, AES encryption key, and logs. This allows any local service account on the host to read the AES encryption key and the encrypted Okta API token.

Detection Guidance

Check directory permissions for the Okta RADIUS Agent installation folders using icacls. Look for write permissions granted to NT SERVICE\ALL SERVICES or CREATOR OWNER. Example command: icacls "C:\Program Files\Okta\Radius Agent".

Impact Analysis

An attacker with access to a local service account could exploit this to read sensitive data like the AES encryption key and Okta API token. This could lead to unauthorized access to Okta services or decryption of encrypted data.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and access controls. GDPR requires protecting personal data, and HIPAA mandates safeguarding sensitive health information. Unauthorized access risks non-compliance.

Mitigation Strategies

Remove write permissions for NT SERVICE\ALL SERVICES and CREATOR OWNER from the agent configuration, AES encryption key, and logs directories. Use icacls to modify permissions. Restrict access to only necessary accounts.

Hi! I’m here to help you understand CVE-2026-78632. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70