CVE-2026-77585: Okta Privileged Access Client

Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days.

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.

Affected products

• Okta Okta Privileged Access Client: from 1.59.0, before 1.111.1 (fixed in 1.111.1)

Published 2026-08-25. Last modified 2026-08-28.