Okta RADIUS Agent CVE-2026-78633

Exploitation requires the attacker to send RADIUS packets to the Okta RADIUS Agent's listening service and reach it over an adjacent network (AV:A) - typically the internal segment where the agent proxies authentication for VPN/MFA, not the public internet. The specific trigger is a Vendor-Specific attribute containing a sub-attribute with a length field of zero, which the parser fails to validate. No authentication is required (PR:N) and no user interaction is needed (UI:N). Limiting factors: the agent must be deployed and reachable on the attacker's network segment, and affected versions are Okta RADIUS Agent 2.17.5 up to (not including) 2.28.0 - environments on 2.28.0+ are not exposed. Impact is limited to denial of new authentications; no data exposure or code execution occurs.

This is a genuine but moderate-priority issue, not a high-CVSS-but-illusory one - in fact the CVSS base score (6.5, Medium) is already restrained and the signals are internally consistent. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes an adjacent-network (AV:A, not full Internet-facing AV:N), low-complexity, unauthenticated attack whose only impact is availability (A:H) with no confidentiality or integrity loss - matching CWE-835 (infinite loop) and the description's worker-thread exhaustion outcome. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation is 'no public exploit identified at time of analysis'; the absence of these signals is itself meaningful - there is no evidence of active or at-scale exploitation. The practical risk is availability of RADIUS-backed authentication (e.g., VPN/MFA logins) rather than data compromise or code execution: a successful attack denies new authentications but does not breach the system. AV:A is the key limiter - the attacker must already reach the RADIUS Agent's network segment, which is typically a trusted internal zone, so real-world risk is highest for environments where the RADIUS listener is exposed to a broad or poorly segmented network.

An attacker with access to the network segment where the Okta RADIUS Agent listens sends a crafted RADIUS packet containing a Vendor-Specific attribute whose sub-attribute length field is set to zero. The unvalidated length causes the parser to loop indefinitely, consuming a worker thread; repeating this exhausts the thread pool and blocks all new RADIUS authentication requests (e.g., VPN or MFA logins). No public exploit code was identified in the provided data, and the attack requires adjacent-network reach rather than internet-wide access.