Okta Radius Agent vulnerabilities

2 CVEs affecting Okta Radius Agent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78633, published 2026-10-13.

More from Okta.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-78633, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in…
• CVE-2026-78632, published 2026-10-13. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing the agent configuration, AES…