CVE-2026-78632: Okta RADIUS Agent Information Disclosure

CVE-2026-78632 Overview

CVE-2026-78632 is an insecure permissions vulnerability in the Okta RADIUS Agent Windows installer. The installer grants write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on directories storing the agent configuration, AES encryption key, and log files. Any local service account on the affected host can read the AES encryption key and the encrypted Okta API token. An attacker with local service-level access can combine both artifacts to decrypt the API token and interact with the Okta tenant. The weakness is classified under CWE-732: Incorrect Permission Assignment for Critical Resource.

Critical Impact
A local service account can read the AES key and encrypted Okta API token, enabling decryption and potential abuse of tenant API access.

Affected Products

Okta RADIUS Agent for Windows
Windows hosts where the agent is installed with the vulnerable installer defaults
Deployments relying on default directory ACLs set by the Okta RADIUS Agent installer

Discovery Timeline

2026-10-13 - CVE-2026-78632 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-78632

Vulnerability Analysis

The Okta RADIUS Agent integrates on-premises Remote Authentication Dial-In User Service (RADIUS) traffic with the Okta identity platform. The agent stores an encrypted Okta API token locally and uses an AES encryption key to decrypt it at runtime. Both artifacts, along with configuration and logs, reside in directories created by the Windows installer.

The installer applies access control lists (ACLs) that grant write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER principals. The NT SERVICE\ALL SERVICES principal includes every service account running on the host. Any local service process can therefore read the directory contents, including the AES key and the encrypted API token.

An attacker who controls or compromises any local service on the host can retrieve both secrets. Once the API token is decrypted, the attacker can issue authenticated calls to the Okta API within the scope granted to the agent token.

Root Cause

The root cause is overly permissive ACL assignment during installation. The installer should restrict access to the agent service identity and administrators only. Including NT SERVICE\ALL SERVICES broadens access to every service on the host, violating least-privilege principles for files holding cryptographic material.

Attack Vector

Exploitation requires local access with service-level privileges. An attacker leverages an existing service account, or a compromised third-party service running on the same host, to read the AES key and encrypted token files. The attacker then decrypts the token offline and uses it against the Okta tenant API. No user interaction is required, and the attack complexity is low.

See the Okta Security Advisory for CVE-2026-78632 for vendor-published technical details.

Detection Methods for CVE-2026-78632

Indicators of Compromise

Read access to the Okta RADIUS Agent configuration, key, or log directories from a process not associated with the agent service account.
Unexpected Okta API activity originating from the RADIUS Agent token outside normal authentication flows.
New or modified files in the agent installation directory written by non-administrative service accounts.

Detection Strategies

Audit the ACLs on the Okta RADIUS Agent installation directory using icacls and alert on the presence of NT SERVICE\ALL SERVICES with write rights.
Enable Windows object access auditing (SACL) on the agent key and token files to log read attempts by non-agent principals.
Correlate local service process activity with file reads of the AES key file to identify unauthorized access.

Monitoring Recommendations

Monitor Okta System Log entries for API token usage patterns that deviate from the RADIUS Agent's expected behavior.
Track service account creation and modification events on hosts running the agent.
Review endpoint telemetry for processes under services.exe touching the agent configuration directory.

How to Mitigate CVE-2026-78632

Immediate Actions Required

Apply the fixed Okta RADIUS Agent version referenced in the Okta Security Advisory.
Rotate the Okta API token used by the RADIUS Agent after remediation to invalidate any copies that may have been exfiltrated.
Audit all Windows hosts running the agent for ACL exposure and prior access by non-agent service accounts.

Patch Information

Okta has published a security advisory for CVE-2026-78632. Refer to the vendor advisory for fixed versions and upgrade guidance.

Workarounds

Manually remove the NT SERVICE\ALL SERVICES and CREATOR OWNER entries from the agent directory ACLs and restrict access to the agent service account and administrators.
Isolate the RADIUS Agent on a dedicated Windows host to reduce the number of local service accounts that could abuse the permissions.
Restrict the Okta API token scope and monitor its usage until the installer-applied permissions are corrected.

bash

# Example: inspect and tighten ACLs on the Okta RADIUS Agent directory
icacls "C:\Program Files (x86)\Okta\Okta RADIUS Agent"
icacls "C:\Program Files (x86)\Okta\Okta RADIUS Agent" /remove "NT SERVICE\ALL SERVICES"
icacls "C:\Program Files (x86)\Okta\Okta RADIUS Agent" /remove "CREATOR OWNER"