CVE-2026-78574: Okta Hyperdrive Privilege Escalation Flaw

CVE-2026-78574 Overview

CVE-2026-78574 is an improper assembly resolution vulnerability in the Okta Hyperdrive Integration plugin. The plugin reads a registry path from the current user's hive to locate a required .NET assembly. It then loads the referenced file via Assembly.LoadFrom without verifying the assembly's signature or integrity. An authenticated local attacker who can write to the referenced user-hive registry key can redirect the load to an attacker-controlled DLL. The unverified assembly then executes within the host process, which may include an elevated installer context. The issue is classified as untrusted search path [CWE-426].

Critical Impact
A local, low-privileged user can achieve code execution in a higher-privileged process by planting an unsigned assembly at a registry-controlled path.

Affected Products

Okta Hyperdrive Integration plugin

Discovery Timeline

2026-09-08 - CVE-2026-78574 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78574

Vulnerability Analysis

The Okta Hyperdrive Integration plugin resolves a dependent .NET assembly at runtime by reading a file path from a registry value stored under HKEY_CURRENT_USER. After retrieving the path, the plugin invokes Assembly.LoadFrom on the referenced file. No Authenticode signature check, hash validation, or strong-name verification is performed before the module is mapped into the process.

Because the registry hive is user-writable, any process running as the current user can modify the value. When the plugin is subsequently loaded by a service or installer that runs with higher privileges, the attacker-controlled path is trusted and the planted assembly executes in that elevated context. The result is a local privilege escalation and integrity compromise of the host process.

Root Cause

The root cause is a violation of the untrusted search path weakness [CWE-426]. The plugin trusts a lookup location that is writable by a lower-privileged principal, and it performs no cryptographic verification of the resolved binary before loading it.

Attack Vector

Exploitation requires local access and low privileges, and no user interaction. The attacker writes a malicious DLL to disk, updates the registry value in the current user's hive to point at that DLL, and waits for the plugin to be loaded by the target process, typically an elevated installer or host application. When the plugin resolves the assembly, the attacker's code runs in the elevated process. Full technical details are available in the Okta Security Advisory CVE-2026-78574.

Detection Methods for CVE-2026-78574

Indicators of Compromise

Unexpected writes to HKEY_CURRENT_USER registry keys referenced by the Okta Hyperdrive Integration plugin for assembly resolution.
Unsigned or unexpected DLLs loaded by the Okta Hyperdrive plugin host process or by installer processes invoking the plugin.
Child processes spawned by an elevated installer that do not match known-good plugin behavior.

Detection Strategies

Monitor module load events (Sysmon Event ID 7) for the plugin host process and alert on modules loaded from user-writable directories such as %APPDATA%, %LOCALAPPDATA%, or %TEMP%.
Audit registry modifications (Sysmon Event ID 13) targeting Okta plugin keys under HKCU\Software.
Correlate registry writes by low-privileged users with subsequent assembly loads by elevated processes to surface the exploitation pattern.

Monitoring Recommendations

Enable Windows registry auditing on plugin-related HKCU keys and forward events to a centralized log platform for review.
Track process integrity levels alongside loaded module paths to detect elevated processes loading user-writable binaries.
Baseline expected DLL load paths for the Okta Hyperdrive Integration plugin and alert on deviations.

How to Mitigate CVE-2026-78574

Immediate Actions Required

Inventory endpoints where the Okta Hyperdrive Integration plugin is installed and identify systems where installers or elevated services load the plugin.
Apply the fix documented in the Okta security advisory as soon as it is available in your environment.
Restrict interactive local access on systems where the plugin is loaded by elevated installers.

Patch Information

Refer to the Okta Security Advisory CVE-2026-78574 for the fixed plugin version and vendor guidance. Deploy the updated plugin across all affected endpoints and validate that assembly resolution no longer relies on unverified user-hive registry paths.

Workarounds

Where the plugin is not required, uninstall it to remove the attack surface.
Set restrictive ACLs on the plugin's HKCU registry keys to prevent modification by standard users, if operationally feasible.
Avoid running installers that invoke the plugin under elevated contexts on multi-user systems until the patch is applied.

bash

# Configuration example: audit modifications to the plugin's HKCU keys
reg add "HKCU\Software\Okta\Hyperdrive" /v _audit /t REG_SZ /d enabled /f
auditpol /set /subcategory:"Registry" /success:enable /failure:enable