CVE-2026-78622 Overview
CVE-2026-78622 is a link-following vulnerability [CWE-59] in the Okta Verify for Windows uninstaller. The uninstaller fails to check whether the user data directory is a filesystem junction before recursively deleting its contents. Because the delete operation runs with elevated privileges and follows the junction target, a local low-privileged attacker can redirect the deletion to arbitrary directories on the system.
Critical Impact
A local authenticated attacker who plants a junction in the user data directory prior to uninstall can trigger recursive deletion of unrelated system or application files, causing integrity loss and denial of service.
Affected Products
- Okta Verify for Windows (uninstaller component)
Discovery Timeline
- 2026-09-08 - CVE-2026-78622 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78622
Vulnerability Analysis
The Okta Verify for Windows uninstaller performs cleanup of its user data directory as part of removal. During this cleanup, the uninstaller enumerates and deletes directory contents while executing under elevated privileges. The code does not check whether the target directory is a reparse point (a filesystem junction or symbolic link) before recursion. This omission maps directly to CWE-59: Improper Link Resolution Before File Access.
When a junction is encountered, the delete API follows the reparse point to the target location and removes files there instead of the original directory. Because the uninstaller runs with SYSTEM-level rights during removal, the deletion is not constrained by the invoking user's permissions. The impact is limited to integrity and availability; no confidentiality loss is indicated.
Root Cause
The root cause is missing validation of filesystem reparse attributes prior to a recursive delete operation. The uninstaller relies on path-based traversal without calling GetFileAttributes to check for FILE_ATTRIBUTE_REPARSE_POINT, and does not open handles with FILE_FLAG_OPEN_REPARSE_POINT to prevent transparent redirection. This TOCTOU-adjacent design flaw allows the local user, who controls the contents of their own profile directory, to substitute a junction pointing to a sensitive target before triggering uninstall.
Attack Vector
Exploitation requires local access with low privileges and user interaction (initiating or approving the uninstall). The attacker replaces or creates the Okta Verify user data directory as an NTFS junction pointing to a directory such as C:\Windows\System32\config or another program's data directory. When the uninstaller runs with elevated rights, the recursive delete follows the junction and removes files at the target path. Refer to the Okta Security Advisory CVE-2026-78622 for vendor details.
See vendor advisory for technical details. No public proof-of-concept
code is available at time of writing. The exploitation pattern follows
the standard NTFS junction abuse technique against privileged file
operations that do not check for reparse points.
Detection Methods for CVE-2026-78622
Indicators of Compromise
- Creation of NTFS junctions or reparse points inside %LOCALAPPDATA%\Okta\OktaVerify or equivalent user data paths shortly before an uninstall event.
- Unexpected mass file deletions in system directories correlated with msiexec.exe or Okta Verify uninstaller process execution.
- Windows Installer events (Event ID 1034, 11724) for Okta Verify removal followed by application or OS failures.
Detection Strategies
- Monitor process telemetry for the Okta Verify uninstaller executing with elevated tokens and enumerate its file delete operations against reparse point targets.
- Alert on mklink /J command execution, CreateSymbolicLink API calls, or PowerShell New-Item -ItemType Junction targeting Okta Verify data directories from non-administrative user contexts.
- Correlate File System audit events (Event ID 4663) for delete access on protected directories initiated by SYSTEM-context installers.
Monitoring Recommendations
- Enable object access auditing on directories commonly targeted by junction abuse, including C:\Windows\System32\config and program data paths.
- Baseline Okta Verify uninstall events across the fleet and flag deviations in file operation counts or target paths.
- Ingest Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) into a SIEM to correlate junction creation with subsequent uninstall activity.
How to Mitigate CVE-2026-78622
Immediate Actions Required
- Restrict local administrative and uninstall privileges to trusted users only, since the flaw requires local access to exploit.
- Inventory endpoints running Okta Verify for Windows and defer uninstall operations until the patched version is deployed.
- Review endpoint logs for pre-existing junctions inside Okta Verify user data directories that may indicate staged exploitation.
Patch Information
Apply the fixed version of Okta Verify for Windows as specified in the Okta Security Advisory CVE-2026-78622. Consult the advisory for the exact fixed build number and deploy through standard software distribution channels before executing any uninstall.
Workarounds
- Avoid running the Okta Verify uninstaller on endpoints where untrusted local users have write access to the user profile.
- Manually verify the Okta Verify user data directory is a regular directory (not a reparse point) prior to uninstall using fsutil reparsepoint query <path>.
- Use configuration management tooling to remove Okta Verify only under controlled administrative sessions with no interactive user logged in.
# Check whether the Okta Verify user data directory is a reparse point
fsutil reparsepoint query "%LOCALAPPDATA%\Okta\OktaVerify"
# Enumerate any junctions under a user profile prior to uninstall
dir /AL /S "%USERPROFILE%"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
