Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Okta RADIUS Agent by Okta
CVE-2026-78633 (GCVE-0-2026-78633)
Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-13 20:16
VLAI
EPSS
VEX
Title
Denial of Service in Okta RADIUS Agent Packet Parser
Summary
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Severity
6.5 (Medium)
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta RADIUS Agent |
Affected:
2.17.5 , < 2.28.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta RADIUS Agent",
"vendor": "Okta",
"versions": [
{
"lessThan": "2.28.0",
"status": "affected",
"version": "2.17.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:16:34.296Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta RADIUS Agent to version 2.28.0 or greater."
}
],
"title": "Denial of Service in Okta RADIUS Agent Packet Parser"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-78633",
"datePublished": "2026-10-13T20:08:40.528Z",
"dateReserved": "2026-08-24T22:04:00.475Z",
"dateUpdated": "2026-10-13T20:16:34.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78632 (GCVE-0-2026-78632)
Vulnerability from nvd – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:39
VLAI
EPSS
VEX
Title
Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
Summary
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:39 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta RADIUS Agent |
Affected:
2.17.5 , < 2.28.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78632",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:39:40.534010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:39:58.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta RADIUS Agent",
"vendor": "Okta",
"versions": [
{
"lessThan": "2.28.0",
"status": "affected",
"version": "2.17.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "Incorrect Permission Assignment for Critical Resource",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:17:04.587Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta RADIUS Agent to version 2.28.0 or greater."
}
],
"title": "Insecure Default File Permissions in Okta RADIUS Agent Windows Installer"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-78632",
"datePublished": "2026-10-13T20:08:32.810Z",
"dateReserved": "2026-08-24T22:04:00.475Z",
"dateUpdated": "2026-10-14T18:39:58.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78633 (GCVE-0-2026-78633)
Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-13 20:16
VLAI
EPSS
VEX
Title
Denial of Service in Okta RADIUS Agent Packet Parser
Summary
The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.
Severity
6.5 (Medium)
CWE
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta RADIUS Agent |
Affected:
2.17.5 , < 2.28.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta RADIUS Agent",
"vendor": "Okta",
"versions": [
{
"lessThan": "2.28.0",
"status": "affected",
"version": "2.17.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:16:34.296Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta RADIUS Agent to version 2.28.0 or greater."
}
],
"title": "Denial of Service in Okta RADIUS Agent Packet Parser"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-78633",
"datePublished": "2026-10-13T20:08:40.528Z",
"dateReserved": "2026-08-24T22:04:00.475Z",
"dateUpdated": "2026-10-13T20:16:34.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78632 (GCVE-0-2026-78632)
Vulnerability from cvelistv5 – Published: 2026-10-13 20:08 – Updated: 2026-10-14 18:39
VLAI
EPSS
VEX
Title
Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
Summary
The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:39 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Okta | Okta RADIUS Agent |
Affected:
2.17.5 , < 2.28.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78632",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:39:40.534010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:39:58.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Okta RADIUS Agent",
"vendor": "Okta",
"versions": [
{
"lessThan": "2.28.0",
"status": "affected",
"version": "2.17.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "Incorrect Permission Assignment for Critical Resource",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:17:04.587Z",
"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"shortName": "Okta"
},
"references": [
{
"url": "https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade the Okta RADIUS Agent to version 2.28.0 or greater."
}
],
"title": "Insecure Default File Permissions in Okta RADIUS Agent Windows Installer"
}
},
"cveMetadata": {
"assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a",
"assignerShortName": "Okta",
"cveId": "CVE-2026-78632",
"datePublished": "2026-10-13T20:08:32.810Z",
"dateReserved": "2026-08-24T22:04:00.475Z",
"dateUpdated": "2026-10-14T18:39:58.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}