CVE-2026-77585

MediumCVSS 5.3

Published: 25/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 26/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target, which may cause the value to be interpreted as a command-line option by the underlying SSH process.

Risk Assessment

This could allow an attacker to inject options into the SSH command, potentially leading to unauthorized access or privilege escalation.

Recommendation

Update the Okta Privileged Access client to a version that includes the fix rejecting a leading hyphen in usernames.

Other vulnerabilities in Okta Privileged Access

CVE-2026-78635Medium
The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior.

Original NVD description (English source)

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS