CVE-2026-78622

MediumCVSS 6.0/10Last modified Sep 10, 2026

Description

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 8, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-786239.9The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datasto CVE-2026-786244.9The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writ CVE-2026-786256.7The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated f CVE-2026-786266.5The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization chec CVE-2026-786275.5The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded i CVE-2026-786286.0The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structu CVE-2026-786295.5The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA f CVE-2026-78638.4Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo CVE-2026-786306.7The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to constr CVE-2026-786315.5The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every success CVE-2026-786325.3The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on th CVE-2026-786336.5The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero ca