CVE-2026-78574

CVE-2026-78574 is an untrusted search path flaw (CWE-426) in the Okta Hyperdrive Integration plugin, which resolves a required .NET assembly from a registry path in the current user's (HKCU) hive without any integrity or signature verification. A local, low-privileged attacker who can control the value or file referenced at that per-user registry path can cause the plugin's host process, or an installer running elevated, to load an attacker-supplied assembly via Assembly.LoadFrom. The unverified assembly then executes in the context of the host process or elevated installer, giving the attacker code execution in that context and potential privilege escalation (CVSS 3.1: 7.5, with high confidentiality and integrity impact, changed scope, high attack complexity, and no user interaction required). Any organization running the Okta Hyperdrive Integration plugin on Windows is potentially affected, with risk concentrated on hosts where untrusted local users can write to the registry path read by privileged processes. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only about a 0.1% probability of exploitation within 30 days.

What to do: Upgrade the Okta Hyperdrive Integration plugin when Okta's advisory identifies a fixed release, and review the Okta PSIRT advisory for the exact affected version range since it is not stated in the current data. As interim mitigations, restrict write access to the HKCU registry path the plugin consults and avoid running the plugin's host process or installer with elevation while untrusted low-privileged sessions can write to that path; enforcing WinTrust signature validation on assemblies loaded via Assembly.LoadFrom is an additional hardening step. Given no known exploitation, absence from KEV, and low EPSS, treat this as scheduled remediation rather than an emergency.