CVE-2025-7371: Okta On-Premises Provisioning Agent · Sensitive Data in Logs
Affects Okta On-Premises Provisioning AgentSource CVE Database V5
Not known to be exploited · CVSS 6.8 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 22 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Okta Okta On-Premises Provisioning Agent | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, European organizations should prioritize the following actions: 1) Immediate upgrade or patching of the Okta On-Premises Provisioning Agent to a version beyond 2.3.0 where this logging issue is resolved. If a patch is not yet available, consider disabling administrator-initiated password resets via the OPP agent or restricting this functionality to trusted administrators only. 2) Implement strict access controls and monitoring on servers running the OPP agent to prevent unauthorized local access. This includes enforcing least privilege principles, using multi-factor authentication for administrative access, and auditing access logs for suspicious activity. 3) Secure log files by applying encryption at rest and restricting read permissions to essential personnel only. Regularly review and sanitize logs to remove sensitive information where feasible. 4) Conduct internal security assessments to detect any unauthorized access to OPP agent servers and investigate potential credential exposure. 5) Educate administrators on secure password reset procedures and the risks of logging sensitive data. 6) Consider deploying endpoint detection and response (EDR) tools to detect lateral movement attempts that could exploit exposed credentials. These measures collectively reduce the risk of exploitation and limit the impact if an attacker gains local access.
Description
Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with access to the local servers running OPP agents to retrieve user personal information and temporary passwords created during password reset. You are affected by this vulnerability if the following preconditions are met: Local server running OPP agent with versions >=2.2.1 and <= 2.3.0, and User account has had an administrator-initiated password reset while using the affected versions.