CVE-2026-78622CWE-59

CVE-2026-78622

Medium · published September 9, 2026

CVSS v3.1
6.0
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-09-09T01:18Z
References (1)
https://trust.okta.com/security-advisories/improper-link-resolution-in-okta-verify-for-windows-uninstaller-data-removal-cve-2026-78622 · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 20:16Z
    Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
    cvelistv5