CVE-2026-78632
Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 14, 2026
- Reserved
- Aug 24, 2026
Description
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | Okta |
Weaknesses
- CWE-732 Incorrect Permission Assignment for Critical Resource
Affected Products
| Product | Versions |
|---|---|
Okta RADIUS AgentOkta |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.