EUVD-2026-74184
GHSA-63pc-vhwj-p2qm
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
Local access only; junction pre-positioning and admin-triggered uninstall drive AC:H and UI:R; low-privilege sufficient to create junction (PR:L); deletion only, no data read (C:N).
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
4DescriptionCVE.org
The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.
AnalysisAI
Filesystem junction abuse during uninstallation of Okta Verify for Windows (versions 5.1.3 through 6.x) allows a low-privileged local user to trigger arbitrary recursive directory deletion with elevated privileges. The uninstaller fails to verify whether the user data directory is an NTFS junction point before deleting its contents as a privileged process, so a pre-positioned junction can redirect the elevated deletion to any directory reachable on the same volume. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a local Windows user account with write access to the Okta Verify user data directory path, which is a default condition for the user whose profile hosts the data directory; (2) the ability to create NTFS junction points, which is a standard capability available to non-administrator users in their own profile directories on Windows without any special configuration; (3) a system administrator or IT technician must actively execute the Okta Verify uninstaller on the same machine after the junction has been placed, creating a timing dependency. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 base score of 6.0 (AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H) is an accurate reflection of the exploitation constraints: the attack is local-only, requires high complexity because the junction must be pre-positioned before the uninstaller is triggered, requires only a low-privileged account to place the junction, and depends on an administrator actively executing the uninstaller. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Okta Verify for Windows to version 7.0.0 or later, which resolves the improper link resolution per the Okta PSIRT advisory at https://trust.okta.com/security-advisories/improper-link-resolution-in-okta-verify-for-windows-uninstaller-data-removal-cve-2026-78622. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allShare
External POC / Exploit Code
Leaving vuln.today