Is CVE-2026-78635 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78635 being exploited in the wild.

How severe is CVE-2026-78635?

Medium severity, with a CVSS score of 5, published 8 September 2026.

Which products and versions are affected?

Okta Privileged Access client 1.18.0 through 1.112.0.

Is there a fix for CVE-2026-78635?

A patch was published on 2026-09-08: Fixed in version 1.113.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78635 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78635?

Check whether you run Okta Privileged Access client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78635: Okta Privileged Access client argument injection in URL handler

CVE-2026-78635 · Severity: medium · CVSS 5 · Published 2026-09-08

Okta Privileged Access is a client application that provides secure SSH access to infrastructure resources. The application's URL protocol handler fails to properly validate user-supplied input, allowing an attacker to inject malicious command-line arguments via a specially crafted link. An attacker could exploit this to modify SSH client behavior and gain unauthorized access or intercept sensitive session data.

Vendors: Okta.

Quick answers

Is CVE-2026-78635 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78635 being exploited in the wild.
How severe is CVE-2026-78635?: Medium severity, with a CVSS score of 5, published 8 September 2026.
Which products and versions are affected?: Okta Privileged Access client 1.18.0 through 1.112.0.
Is there a fix for CVE-2026-78635?: A patch was published on 2026-09-08: Fixed in version 1.113.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78635 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78635?: Check whether you run Okta Privileged Access client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an argument injection flaw (CWE-88) in the Okta Privileged Access client's URL handler for the scaleft:// protocol. When the handler constructs command-line arguments to pass to the underlying SSH client, it fails to insert an option terminator (--) before appending the target value. This allows an attacker to craft a scaleft:// link with a target parameter beginning with a hyphen, which the CLI framework then interprets as a command-line flag rather than a positional argument. The attack requires user interaction (clicking a malicious link) but no authentication. An attacker can achieve limited impact through command-line flag injection to modify SSH client behavior. The vulnerability affects versions 1.18.0 through 1.112.0 and is fixed in version 1.113.0.

Affected products

Okta Privileged Access client 1.18.0 through 1.112.0

Timeline

2026-09-08: disclosed
2026-09-08: patched: Fixed in version 1.113.0

References

https://trust.okta.com/security-advisories/improper-input-validation-in-the-okta-privileged-access-ssh-client-url-handler-argument-cve-2026-78635

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.