# CVE-2026-78632: Insecure Default File Permissions in Okta RADIUS Agent Windows Installer

> CVE-2026-78632: Insecure Default File Permissions in Okta RADIUS Agent Windows Installer. CVSS 5.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-78632
Last updated: 2026-10-15T20:38:04Z

- Published: 2026-10-13 20:08 UTC · Updated: 2026-10-15 20:38 UTC · Assigner: Okta
- CVSS: 5.3 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- EPSS: 0.07%, 0th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-732

## Description

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

## Affected vendors and products

- Okta: Okta RADIUS Agent

## Tracked companies

- [Okta](https://rewindex.com/company/okta.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78632)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-78632)
- [https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632](https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-78632 · Markdown: https://rewindex.com/cve/CVE-2026-78632.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-78632 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:01.270Z