CVE-2026-78622: Okta Verify For Windows

Medium severity, CVSS 6.0. EPSS: 0.1% chance of exploitation in the next 30 days.

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.

Affected products

• Okta Okta Verify For Windows: from 5.1.3, before 7.0.0 (fixed in 7.0.0)

Published 2026-09-08. Last modified 2026-09-10.