OktaOKTA-19JA9UV

Insecure Default File Permissions in Okta RADIUS Agent Windows Installer CVE-2026-78632...

CVE-2026-78632 · Published Oct 13, 2026

Medium5.3

No fix yet

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. To remediate this vulnerability, upgrade the Okta RADIUS Agent to version 2.28.0 or greater.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 14Severity: Unrated to Medium

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Severity from: NVD

More Okta advisories

All Okta

Medium 6.0Oct 13

Improper Input Validation in the Okta Credential Provider for Windows CVE-2026-78628...CVE-2026-78628no fix yet Medium 5.4Oct 13

Missing Verification of auth_time Claim in auth0.js CVE-2026-107371 - Oct 13, 2026CVE-2026-107371no fix yet Medium 5.3Oct 13

Improper Request Handling for Active Directory Logins in auth0-lock CVE-2026-107370 - Oct...CVE-2026-107370no fix yet Medium 6.5Oct 13

Denial of Service in Okta RADIUS Agent Packet Parser CVE-2026-78633 - Oct 13, 2026CVE-2026-78633no fix yet Medium 5.3Oct 13

Out-of-Range Timestamp Claim Handling in auth0/java-jwt CVE-2026-85473 - Oct 13, 2026CVE-2026-85473no fix yet Medium 6.1Oct 13

Improper Validation of Post-Login Redirect URL in nextjs-auth0 CVE-2026-107369 - Oct 13...CVE-2026-107369no fix yet