CVE-2026-78632
Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
| CWE | CWE-732 |
| Vendor | okta |
| Product | okta radius agent |
| Published | Oct 13, 2026 |
| Last Updated | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for okta okta radius agent
Be the first to know when new medium vulnerabilities affecting okta okta radius agent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Okta / Okta RADIUS Agent
2.17.5 < 2.28.0