Insecure Default File Permissions in Okta RADIUS Agent Windows Installer CVE-2026-78632 - Oct 13, 2026

Description

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

Preconditions

A user has local authenticated access on the Windows host, and
The user can execute code in the context of a Windows service account, including low-privilege service accounts.

Affected product and versions

Customers using the Okta RADIUS Agent on Windows versions 2.17.5 to 2.27.0 are affected.

Customer Recommendations

To remediate this vulnerability, upgrade the Okta RADIUS Agent to version 2.28.0 or greater.

Resolution

The vulnerability is present in Okta RADIUS Agent versions 2.17.5 to 2.27.0, and is resolved in version 2.28.0.

CVE details

CVE ID	CVE-2026-78632
Published Date	2026-10-13
Vulnerability Type	Incorrect Access Control (Insecure File Permissions)
CWE	CWE-732 – Incorrect Permission Assignment for Critical Resource
CVSS v3	Score: 5.3 Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L