Security Advisory Summary: October 2026

Okta is committed to transparency and keeping the identity ecosystem secure, which is why we're sharing a confirmed set of vulnerabilities we’ve identified after using advanced AI Frontier models to proactively scan our code as part of our continuous security hardening work. 

• Okta RADIUS Agent
• Okta MFA Credential Provider for Windows

Administrators must perform appropriate version upgrades to maintain a secure environment

Our priority is to help customers quickly find the information that is relevant to them and understand any actions they may need to take. Our monitoring telemetry shows no evidence of exploitation, with discovered vulnerabilities of Medium severity (CVSS 4.0–6.9). 

Review the security advisories and apply the necessary updates. Each advisory includes specific, actionable guidance so you can take the steps that matter for your organization.

1. Review Okta Security Advisories: Public-facing advisories are the primary source of issue-specific information and guidance.

2. Stay up to date: Check the Okta Security Advisories page regularly for the latest published guidance.

Security Advisories categorized by product

Review the listed categories to find the specific security advisories and corresponding product update links for each product.

Okta MFA Credential Provider for Windows

• Improper Input Validation in the Okta Credential Provider for Windows - Oct 13, 2026

Okta RADIUS Agent

• Insecure Default File Permissions in Okta RADIUS Agent Windows Installer - Oct 13, 2026
• Denial of Service in Okta RADIUS Agent Packet Parser - Oct 13, 2026

Why are we sharing this security guidance?

This security guidance reflects our ongoing focus on continuous hardening and proactive vulnerability identification. By providing timely, accessible guidance, we help our customers understand what's relevant to their environments and take action when needed. 

We're committed to raising the bar for the identity industry and delivering on the Okta Secure Identity Commitment (OSIC). Security is foundational to identity, and we invest in keeping our products hardened and secure while advancing transparency and stronger security practices across the ecosystem.

How can you confirm what products you are using?

Launch the Okta Admin Console for your Org, and verify individual products by using the information below.

• For the Okta RADIUS Agent, navigate to Dashboard > Integration Agents. The existence of the RADIUS tab confirms the agent is in use in your environment.
• For the Okta MFA Credential Provider for Windows, navigate to Application and Resources > Applications, then search for “Microsoft RDP (MFA)” to verify that there’s an active integration.

Additional Resources

• View Okta Security Advisories — Access the Okta Trust Site Security Advisories page for the complete CVE list and applicable updates

• Subscribe to security updates — Follow our Security Advisories via RSS feed to stay current as new guidance is published

• Explore how we found these vulnerabilities — Read our Security Blog article: Hunting Vulnerabilities Using Frontier Models for more on how we used advanced AI capabilities to proactively scan our code, and the key lessons we learned

• Learn more about the Okta Secure Identity Commitment (OSIC) — Understand our ongoing commitment to transparency and continuous hardening

• We’re here to help — For additional assistance, contact us by using the Okta Support Center.