---
id: CVE-2026-78632
title: >-
  The Okta RADIUS Agent Windows installer assigns write permissions to the NT
  SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories
  containing the agent configuration, AES encryption key, and logs
summary: >-
  The Okta RADIUS Agent Windows installer assigns write permissions to the NT
  SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories
  containing the agent configuration, AES encryption key, and logs. These
  permissions…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-732
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T21:18:21.747'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78632'
references:
  - url: >-
      https://trust.okta.com/security-advisories/insecure-default-file-permissions-in-okta-radius-agent-windows-installer-cve-2026-78632
    label: psirt@okta.com
tags:
  - nvd
ingestedAt: '2026-10-13T21:58:14.189Z'
---

## Overview

The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES encryption key, and logs. These permissions allow any local service account on the host to read the AES encryption key and the encrypted Okta API token.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.