CVE-2026-78632 Okta CVE debrief

Who should care

Okta RADIUS Agent administrators and security personnel responsible for monitoring and remediating vulnerabilities in Windows environments should be aware of this vulnerability and take action to verify and remediate file permissions. This includes reviewing compensating controls for exposed systems, monitoring for local service account access to sensitive data, and considering upgrades to version 2.28.0 or later.

Why it matters

The CVE-2026-78632 vulnerability in Okta RADIUS Agent Windows installer poses a medium risk due to insecure default file permissions, allowing local service accounts to access sensitive data.

• Local service accounts can read AES encryption key and encrypted Okta API token.
• Potential unauthorized access to sensitive data.
• Requires verification of file permissions and remediation to restrict access.
• Monitoring for local service account access to sensitive data is necessary.

Technical summary

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICEALL SERVICES and CREATOR OWNER security principals on directories containing agent configuration, AES encryption key, and logs. This allows local service accounts to read the AES encryption key and encrypted Okta API token, potentially leading to unauthorized access to sensitive data. The vulnerability affects Okta RADIUS Agent administrators and security personnel responsible for monitoring and remediating vulnerabilities in Windows environments.

Defensive priority

Medium priority for Okta RADIUS Agent administrators to verify and remediate file permissions.

Recommended defensive actions

• Verify file permissions for Okta RADIUS Agent configuration, AES encryption key, and logs.
• Restrict write permissions to authorized personnel only.
• Monitor for local service account access to sensitive data.
• Consider upgrading to version 2.28.0 or later.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the insecure default file permissions in Okta RADIUS Agent Windows installer. The vulnerability allows local service accounts to access sensitive data, including the AES encryption key and encrypted Okta API token. The insecure permissions are assigned to the NT SERVICEALL SERVICES and CREATOR OWNER security principals on directories containing agent configuration, AES encryption key, and logs. The Okta security advisory and CVE Program record provide additional context on the affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.