CVE-2026-78632
Medium
Description
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Okta RADIUS Agent
PublishedOct 13, 2026
First seenOct 13, 2026
Weakness typeCWE-732CWE-732
How to fix
Update
- Okta Okta RADIUS Agent2.28.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Okta Okta RADIUS Agent | 2.17.5 ≤ v < 2.28.0 | 2.28.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.