Okta RADIUS Agent EUVD-2026-100484

Requires an existing local account or service principal on a Windows host running Okta RADIUS Agent version 2.17.5 up to (but not including) 2.28.0, where the installer set insecure directory ACLs granting write/read to NT SERVICE\ALL SERVICES and CREATOR OWNER on the folders holding the agent configuration, AES encryption key, and logs. The specific limiting factor is that ANY local service account can read the key and encrypted token, so the prerequisite is simply running code in any local service context - no admin rights and no user interaction are needed (PR:L, UI:N). Exploitation is strictly local (AV:L): it is not reachable over the network, and hosts patched to 2.28.0 or later, or with corrected directory ACLs, are not exploitable.

This is a genuine but low-priority local information-disclosure flaw (CWE-732) rather than a widespread remote-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, 5.3 Medium) consistently indicates that exploitation requires local access and an existing low-privilege account on the host, with low technical impact across confidentiality, integrity, and availability - all signals agree on constrained, non-remote risk. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV and no public POC is referenced, meaning there is no public exploit identified at time of analysis and no evidence of active exploitation. One nuance worth flagging: although the vendor-assigned vector rates confidentiality as only C:L, the disclosed material is the AES encryption key AND the encrypted Okta API token together - recovering both effectively yields the cleartext API token, a credential whose compromise can have impact beyond the local host; this is arguably underweighted at C:L (see assessed vector). Priority should therefore be moderate: remediate via the available patch during normal maintenance, but this is not an emergency unless the host already has untrusted local service accounts.

An attacker (or malicious/compromised low-privilege service running under any local service account) on a Windows host running the Okta RADIUS Agent reads the agent's configuration directory, which the installer left world-writable to NT SERVICE\ALL SERVICES and CREATOR OWNER. They retrieve the AES encryption key and the encrypted Okta API token, decrypt the token offline, and use it to authenticate to Okta's API. No public POC is referenced, and exploitation requires pre-existing local access (CVSS AV:L, PR:L), so this is a post-compromise privilege/credential escalation rather than an initial access vector.