EUVD-2026-74188
GHSA-pvm6-cj89-m3wx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requiring low-privilege OS account; config-write and service-restart are low-complexity local conditions; full service account compromise yields C:H/I:H/A:H.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
2DescriptionCVE.org
The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.
AnalysisAI
Local privilege escalation in Auth0 AD/LDAP Connector versions up to and including 6.5.0 allows a low-privileged local user to modify the connector's configuration file due to improper permission handling during service startup processing. When the connector service restarts - whether scheduled, OS-triggered, or manually - the tampered configuration value is evaluated, resulting in code execution with the privileges of the service account running the connector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing low-privileged OS account on the host machine running Auth0 AD/LDAP Connector version 6.5.0 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the local escalation path: an attacker needs only a low-privileged OS account, no special configuration, and no interaction from other users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Auth0 AD/LDAP Connector to the version identified as fixed in the Okta advisory at https://trust.okta.com/security-advisories/local-privilege-escalation-in-auth0-ad-ldap-connector-cve-2026-85983 - the exact patched release number is not independently confirmed from available intelligence beyond the 'affected ≤ 6.5.0' bound, so verify the target version directly from that page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Auth0 AD/LDAP Connector version 6.5.0 or earlier and document their locations and service account configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today