Is CVE-2026-78633 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78633 being exploited in the wild.

How severe is CVE-2026-78633?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

Okta RADIUS Agent 2.17.5 to 2.27.0.

Is there a fix for CVE-2026-78633?

Yes: fixed in Okta RADIUS Agent 2.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78633 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-78633?

Check whether you run Okta RADIUS Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78633: Okta RADIUS Agent denial of service in packet parser

CVE-2026-78633 · Severity: medium · CVSS 6.5 · Published 2026-10-13

The Okta RADIUS Agent is a system that handles authentication requests from network devices. An attacker with network access can send specially crafted packets that cause the agent to enter an infinite loop, exhausting its worker threads and preventing legitimate users from authenticating. This results in a complete denial of service for RADIUS authentication.

Vendors: Okta.

Quick answers

Is CVE-2026-78633 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78633 being exploited in the wild.
How severe is CVE-2026-78633?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Okta RADIUS Agent 2.17.5 to 2.27.0.
Is there a fix for CVE-2026-78633?: Yes: fixed in Okta RADIUS Agent 2.28.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78633 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-78633?: Check whether you run Okta RADIUS Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Okta RADIUS Agent 2.28.0

Technical details

The RADIUS Agent fails to validate sub-attribute length when parsing Vendor-Specific attributes; a zero-length sub-attribute triggers an infinite loop (CWE-835) that exhausts worker threads. An unauthenticated attacker on an adjacent network can send malformed Access-Request packets to the RADIUS UDP port to trigger the condition. No privilege escalation or data access is possible; impact is limited to availability.

Affected products

Okta RADIUS Agent 2.17.5 to 2.27.0

Timeline

2026-10-13: disclosed

References

https://trust.okta.com/security-advisories/denial-of-service-in-okta-radius-agent-packet-parser-cve-2026-78633

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.