Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
CVE-2026-78632
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-78632
Okta RADIUS Agent
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Okta",
"product": "Okta RADIUS Agent",
"versions": [
{
"status": "affected",
"version": "2.17.5",
"lessThan": "2.28.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-78632
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #22998 · Revision 1
- Added to Heist Feed
- Publisher date