CVE-2026-78632: Incorrect Permission Assignment for Critical Resource in Okta Okta RADIUS Agent

The Okta RADIUS Agent Windows installer grants write permissions to NT SERVICE\ALL SERVICES and CREATOR OWNER on directories that store the agent configuration, AES encryption key, and logs. This permission assignment flaw enables any local service account on the host machine to access and read the AES encryption key and the encrypted Okta API token, which are critical security resources. The affected versions are from 2.17.5 up to but not including 2.28.0. The CVSS 3.1 base score is 5.3, reflecting a medium severity with local attack vector, low complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with local service account access on the affected host can read sensitive cryptographic keys and encrypted API tokens. This exposure could lead to unauthorized access or manipulation of Okta RADIUS Agent operations or associated Okta API interactions. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local service account permissions on the affected directories as a temporary mitigation if possible.