Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Okta Privileged Access Client by Okta
CVE-2026-78635 (GCVE-0-2026-78635)
Vulnerability from nvd – Published: 2026-09-08 20:14 – Updated: 2026-09-10 14:38
VLAI
EPSS
VEX
Title
Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
Summary
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 14:38 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Privileged Access Client |
Affected:
1.18.0 , < 1.113.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T14:38:13.258491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T14:38:28.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Privileged Access Client",
"vendor": "Okta",
"versions": [
{
"lessThan": "1.113.0",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client\u0027s behavior."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T20:14:00.691Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta Privileged Access client to version 1.113.0."
}
],
"title": "Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-78635",
"datePublished": "2026-09-08T20:14:00.691Z",
"dateReserved": "2026-08-24T22:06:37.295Z",
"dateUpdated": "2026-09-10T14:38:28.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77585 (GCVE-0-2026-77585)
Vulnerability from nvd – Published: 2026-08-25 20:07 – Updated: 2026-08-26 19:46
VLAI
EPSS
VEX
Title
Improper Validation of SSH Target in Okta Privileged Access Client
Summary
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:35 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Privileged Access Client |
Affected:
1.59.0 , < 1.111.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:35:41.539004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:46:42.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Privileged Access Client",
"vendor": "Okta",
"versions": [
{
"lessThan": "1.111.1",
"status": "affected",
"version": "1.59.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T20:09:45.290Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cve-2026-77585"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta Privileged Access client to version 1.111.1 or greater."
}
],
"title": "Improper Validation of SSH Target in Okta Privileged Access Client"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-77585",
"datePublished": "2026-08-25T20:07:20.216Z",
"dateReserved": "2026-08-20T20:46:14.393Z",
"dateUpdated": "2026-08-26T19:46:42.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78635 (GCVE-0-2026-78635)
Vulnerability from cvelistv5 – Published: 2026-09-08 20:14 – Updated: 2026-09-10 14:38
VLAI
EPSS
VEX
Title
Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument
Summary
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 14:38 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Privileged Access Client |
Affected:
1.18.0 , < 1.113.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T14:38:13.258491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T14:38:28.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Privileged Access Client",
"vendor": "Okta",
"versions": [
{
"lessThan": "1.113.0",
"status": "affected",
"version": "1.18.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client\u0027s behavior."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T20:14:00.691Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta Privileged Access client to version 1.113.0."
}
],
"title": "Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-78635",
"datePublished": "2026-09-08T20:14:00.691Z",
"dateReserved": "2026-08-24T22:06:37.295Z",
"dateUpdated": "2026-09-10T14:38:28.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77585 (GCVE-0-2026-77585)
Vulnerability from cvelistv5 – Published: 2026-08-25 20:07 – Updated: 2026-08-26 19:46
VLAI
EPSS
VEX
Title
Improper Validation of SSH Target in Okta Privileged Access Client
Summary
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:35 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta Privileged Access Client |
Affected:
1.59.0 , < 1.111.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:35:41.539004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:46:42.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta Privileged Access Client",
"vendor": "Okta",
"versions": [
{
"lessThan": "1.111.1",
"status": "affected",
"version": "1.59.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T20:09:45.290Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cve-2026-77585"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta Privileged Access client to version 1.111.1 or greater."
}
],
"title": "Improper Validation of SSH Target in Okta Privileged Access Client"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-77585",
"datePublished": "2026-08-25T20:07:20.216Z",
"dateReserved": "2026-08-20T20:46:14.393Z",
"dateUpdated": "2026-08-26T19:46:42.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}