CVE-2026-78632: Insecure Default File Permissions in Okta RADIUS Agent Windows Installer

Published Oct 13, 2026

Updated

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

Affected Software

1 affected component

Okta RADIUS Agent

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Okta RADIUS Agent to a version that resolves this vulnerability.
Fixed in 2.28.0

Event History

Oct 13, 2026

CVE Published

via MITRE·08:08 PM

Data Sourced

via MITRE·08:08 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed?

Windows hosts where the Okta RADIUS Agent was installed with the affected installer permissions are exposed. The affected directories contain the agent configuration, AES encryption key, and logs.

What access does an attacker need?

An attacker needs local access as a service account on the host. Any local service account can use the granted permissions to read the AES encryption key and encrypted Okta API token.