CVE-2026-77585: Improper Validation of SSH Target in Okta Privileged Access Client

Published Aug 25, 2026

Updated

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.

Affected Software

1 affected component

Okta Privileged Access Client

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.111.1 or greater

Event History

Aug 25, 2026

CVE Published

via MITRE·08:07 PM

Data Sourced

via MITRE·08:07 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

Exploitation requires local access and user interaction. The attacker must cause an SSH target whose username begins with a hyphen to be processed by the Okta Privileged Access client, allowing that value to be interpreted as an option by the underlying SSH process.

What is the potential impact?

The issue can expose confidential information and allow limited impact to integrity. Availability impact is not indicated by the supplied severity vector.

CVE-2026-77585: Improper Validation of SSH Target in Okta Privileged Access Client

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the potential impact?