CVE-2026-85983: Auth0 AD/LDAP Connector RCE Vulnerability

CVE-2026-85983 Overview

CVE-2026-85983 is a local privilege escalation vulnerability in the Auth0 Active Directory/Lightweight Directory Access Protocol (AD/LDAP) Connector. The connector improperly processes a configuration value during service startup. A low-privileged user on the host system can modify the connector's configuration file. When the service restarts, the tampered configuration triggers code execution under the privileges of the service account. The flaw is categorized under [CWE-94] Improper Control of Generation of Code.

Critical Impact
Local attackers with limited host access can escalate to the service account privileges and achieve arbitrary code execution on systems running the Auth0 AD/LDAP Connector.

Affected Products

Auth0 AD/LDAP Connector (Okta)
Deployments integrating on-premises Active Directory or LDAP with Auth0
Windows and Linux hosts running the connector service

Discovery Timeline

2026-09-08 - CVE-2026-85983 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-85983

Vulnerability Analysis

The Auth0 AD/LDAP Connector runs as a persistent service that bridges on-premises directory services with the Auth0 identity platform. During startup, the connector reads a configuration value without adequate validation or integrity checks. An attacker who can write to the configuration file, but who otherwise holds only low privileges on the host, can inject content that the service interprets as executable code.

Because the service typically runs under a dedicated or elevated account, the injected code executes with those higher privileges. This creates a local privilege escalation path from any standard user account with write access to the connector's configuration store.

Root Cause

The root cause is improper handling of configuration input during service initialization, classified as [CWE-94] Improper Control of Generation of Code ("Code Injection"). The connector treats configuration data as trusted and does not enforce integrity or restrict interpretation of the value before use during startup.

Attack Vector

Exploitation requires local access with low privileges on the host running the connector. The attacker modifies the configuration to embed malicious content, then waits for or triggers a service restart. On restart, the connector processes the tampered value and executes code as the service account.

See the Okta Security Advisory CVE-2026-85983 for the vendor's technical description. No public proof-of-concept is available at the time of writing.

Detection Methods for CVE-2026-85983

Indicators of Compromise

Unexpected modifications to the Auth0 AD/LDAP Connector configuration file outside of change windows or administrator activity.
Child processes spawned by the connector service that do not match legitimate operational behavior.
Service restarts of the AD/LDAP Connector initiated by non-administrative user sessions.

Detection Strategies

Monitor file integrity on the connector's installation directory and configuration files, alerting on writes by non-privileged accounts.
Correlate service restart events with the identity of the initiating user and preceding file-write activity.
Baseline the process tree of the connector service and flag anomalous child processes, shell invocations, or scripting hosts.

Monitoring Recommendations

Enable command-line auditing and process creation logging on hosts running the connector.
Forward configuration-file audit events and service control manager events to a central log platform for correlation.
Review privileged-account activity on connector hosts for signs of lateral movement after suspected restarts.

How to Mitigate CVE-2026-85983

Immediate Actions Required

Apply the fixed version of the Auth0 AD/LDAP Connector as directed by the Okta security advisory.
Restrict filesystem permissions on the connector configuration file and installation directory to administrators and the service account only.
Audit local group membership on connector hosts and remove unnecessary standard user accounts.

Patch Information

Okta has published remediation guidance in the Okta Security Advisory CVE-2026-85983. Administrators should upgrade to the connector version identified in that advisory and verify integrity after installation.

Workarounds

Treat connector hosts as tier-0 identity infrastructure and limit interactive logon to administrators only.
Enforce file-system access control lists that prevent write access to the connector's configuration by non-administrative users.
Restrict the ability of standard users to trigger service restarts of the AD/LDAP Connector.

bash

# Configuration example: restrict access to connector directory (Windows)
icacls "C:\Program Files (x86)\Auth0\AD LDAP Connector" /inheritance:r
icacls "C:\Program Files (x86)\Auth0\AD LDAP Connector" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"