CVE-2026-77585: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Okta Okta Privileged Access Client

The Okta Privileged Access Client improperly neutralizes special elements in the username field used for SSH targets. Specifically, it allows usernames beginning with a hyphen, which can be interpreted as command-line options by the underlying SSH process, resulting in OS command injection. This vulnerability is identified as CVE-2026-77585 and affects version 1.59.0 of the client. The CVSS 3.1 base score is 5.3, reflecting medium severity with local attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. There is no known exploit in the wild and no vendor-provided patch or mitigation at this time.

Successful exploitation could allow an attacker to execute unintended OS commands via the SSH process by manipulating the username input. This could lead to confidentiality breaches due to the high confidentiality impact rating. However, exploitation requires local access, high attack complexity, and user interaction, limiting the overall risk. There is no impact on availability and only low impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using usernames starting with a hyphen in SSH targets with the Okta Privileged Access Client version 1.59.0. Monitor official Okta advisories for updates and apply patches promptly once released.