CVE-2026-78574

Executive Summary

CVE-2026-78574 is an unverified assembly-loading vulnerability in the Okta Hyperdrive Integration plugin. The plugin resolves a required assembly through a registry path in the current user's hive and loads it via Assembly.LoadFrom without signature verification, allowing a locally authenticated attacker to plant a malicious DLL at that location. Successful exploitation executes attacker-controlled code in the context of the host process or an elevated installer, yielding high confidentiality and integrity impact (CVSS 7.5). No patch exists from any tracked source, and no public exploit or CISA KEV listing has been reported; however, the weakness is trivially weaponizable on single-user or shared Windows workstations.

Technical Analysis

The vulnerability resides in the Okta Hyperdrive Integration plugin's assembly resolution logic. Per the NVD description, the plugin resolves a required assembly using a registry path located within the current user's hive (e.g., HKEY_CURRENT_USER), and subsequently loads the assembly via the .NET Assembly.LoadFrom method. Critically, the plugin does not perform any integrity or signature verification on the referenced binary before loading it.

The flaw is classified under CWE-426 (Untrusted Search Path). The mechanism parallels classic DLL planting / search-order hijacking but is uniquely enabled by the use of a user-writable registry value to determine the assembly path. Because the current user's hive is writable by the authenticated user without special privileges, any local user — including a low-privileged one — can modify the registry path to point to a location they control and drop a malicious assembly there.

At the code level, Assembly.LoadFrom is a .NET API that loads an assembly from a specified file path. When invoked without cryptographic name verification or strong-name/signature checks, it will load any valid .NET assembly present at that path. The NVD description explicitly states the assembly is loaded "without signature validation," which indicates the developers omitted checks such as StrongNameIdentityPermission, Authenticode signature validation, or publisher policy enforcement.

The execution context is twofold: (1) the host process (likely a browser extension helper, a sync agent, or an integration service) that imports the Okta Hyperdrive plugin, and (2) an "elevated installer" — meaning the same vulnerable resolution logic is exercised during installation, potentially with elevated privileges. This second vector is particularly severe because a low-privileged attacker who can pre-seed the registry path before an administrator runs the installer could achieve privilege escalation to SYSTEM or Administrator, depending on the installer's execution context.

Attack surface: local, requiring authenticated access to a Windows system where the Okta Hyperdrive Integration plugin is installed. The attack complexity is rated High (AC:H) because the attacker must win a race condition or rely on the installer being invoked after the registry path is poisoned, and because the plugin may only load the assembly under specific conditions (e.g., during a sync operation, at plugin initialization, or during install/update).

Affected versions are unknown; no vendor disclosure, patch, or advisory has been identified. The plugin could not be correlated to a specific version range from public data.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class described (CWE-426 — untrusted search path / DLL planting via user-writable registry).

Step 1 — Reconnaissance / Target Identification: The attacker first identifies a Windows endpoint where the Okta Hyperdrive Integration plugin is present. Discovery methods include checking installed programs, enumerating running processes for Okta-related services, inspecting browser extension manifests, or querying HKEY_CURRENT_USER\Software\... for the registry value that the plugin uses to resolve the assembly. The attacker also verifies they have unprivileged local access (e.g., via a standard user account, a compromised service account, or physical access to a shared workstation).

Step 2 — Triggering the Flaw Class: The attacker writes a malicious .NET assembly (a DLL) to a location they control (e.g., %TEMP%, a user-writable folder, or a network share). They then modify the registry value in their own user hive (HKEY_CURRENT_USER) to point the plugin's assembly-resolution path to that malicious DLL. Because the registry hive is user-writable, no privilege escalation is required for this step.

Step 3 — Payload / Execution Method: The attacker waits for the plugin to initialize or for the user/administrator to trigger an action that causes the plugin to resolve and load the assembly. When the plugin invokes Assembly.LoadFrom on the poisoned path, the malicious DLL is loaded into the host process. If the victim is an administrator running the Okta Hyperdrive installer (which elevates), and the installer exercises the same vulnerable resolution code, the payload executes with elevated privileges — effectively converting a local unprivileged foothold into code execution at the installer's integrity level.

Step 4 — Post-Exploitation Impact: Once the malicious assembly executes inside the host process, the attacker gains code execution in that context — typically the logged-in user's session for the regular plugin process, or SYSTEM/Administrator during elevated installation. With high confidentiality and integrity impact (C:H/I:H per CVSS), the attacker can read sensitive data accessible to the process (e.g., Okta session tokens, SSO credentials, browser cookies, configuration files), modify system state, or establish persistence by keeping the DLL planted. Because the CVSS scope is changed (S:C), the compromise can extend beyond the vulnerable component, potentially reaching corporate identity infrastructure if the compromised process holds delegated access to Okta APIs or Active Directory.

Impact Assessment

Business Impact: A successful exploit yields arbitrary code execution on the victim workstation. In enterprise environments where Okta Hyperdrive Integration is deployed to synchronize identity data or facilitate integration between Okta and on-premises systems (e.g., AD bridges, HRIS sync agents, privileged-access workstations), the compromised process may hold service account credentials with broad delegated permissions. The elevated installer vector compounds this: any unprivileged user who can anticipate or force a reinstall/upgrade of the plugin on a shared machine could escalate to administrative privileges, compromising the entire endpoint and, potentially, adjacent identity infrastructure.

Affected Systems: Windows hosts with the Okta Hyperdrive Integration plugin installed. The exact version range is unknown due to absent vendor disclosure. Systems where users have non-admin accounts but share a physical/remote workstation (kiosks, VDI fleets, lab machines) are at elevated risk because the user-writable registry path is exploitability per-user.

Blast Radius: CVSS 3.1 base score of 7.5 with vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. Local attack vector, high attack complexity (race or user-action dependency), low privileges required, no user interaction. Scope change to "Changed" indicates the compromised plugin process can affect resources beyond its own security authority — e.g., Okta API tokens, other applications run by the same user, or, during installation, the broader system. Confidentiality and integrity impacts are High; availability is unaffected (A:N). The absence of a patch and lack of vendor advisory elevate real-world risk even though the score is not "critical," because the flaw is trivially exploitable on any endpoint where the plugin runs, and the privilege-escalation path through the installer removes the primary barrier (admin boundary).

Detection Guidance

Detection rules below assume visibility into process creation, file writes, registry modifications, and .NET assembly loading events on Windows endpoints, as well as network egress monitoring for post-exploitation callbacks.

Sigma Rule

title: Okta Hyperdrive Plugin Assembly Load from User-Writable Path
id: 9c2a4d1e-5f4a-4e10-9c8d-29f6b0a7e1f3
status: experimental
description: Detects the Okta Hyperdrive Integration plugin loading a .NET assembly from a path resolved via HKCU registry, which may indicate CVE-2026-78574 exploitation.
logsource:
  product: windows
  category: process_creation
detection:
  selection_image:
    Image|endswith:
      - '\OktaHyperdriveIntegration.exe'
      - '\OktaHyperdrivePlugin.exe'
      - '\OktaHyperdriveSetup.exe'
  selection_cli:
    CommandLine|contains:
      - 'LoadFrom'
      - 'Assembly.Load'
  selection_path:
    # Path resolved from HKCU hive pointing to non-standard dirs
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Temp\'
  condition: selection_image and selection_path
  timeframe: 5m
level: high
falsepositives:
  - Legitimate plugin updates that temporarily stage assemblies in user-writable dirs before relocation
tags:
  - attack.t1574
  - cve.2026-78574

YARA Rule

rule Okta_Hyperdrive_Unverified_Assembly_Load
{
    meta:
        author = "Valterit Threat Intel"
        description = "Detects Okta Hyperdrive Integration plugin binaries or msi payloads that load assemblies from HKCU registry paths without signature validation (CVE-2026-78574)."
        cve = "CVE-2026-78574"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "Assembly.LoadFrom" ascii wide nocase
        $s2 = "HKEY_CURRENT_USER" ascii wide nocase
        $s3 = "Software\\" ascii wide nocase
        $s4 = "Okta" ascii wide nocase
        $s5 = "Hyperdrive" ascii wide nocase
        $s6 = ".dll" ascii wide nocase
        $s7 = "LoadFrom" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and   // MZ header
        ( 2 of ($s1, $s2, $s7)  and
          any of ($s4, $s5) and
          $s6
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78574 Okta Hyperdrive Exploit Attempt - Suspicious DLL Download"; content:"Okta"; nocase; http.header_names; content:"Hyperdrive"; nocase; http.header_names; content:".dll"; http.uri; content:"Temp"; http.uri; content:"AppData"; http.uri; classtype:attempted-user; sid:202678574; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

// EQL rule for Windows process and file events
sequence by host.name, user.name with maxspan=10m
  [ registry where
      registry.key : "*HKEY_CURRENT_USER*Okta*" and
      registry.value : "*Hyperdrive*" and
      registry.data : "*\.dll*"
  ]
  [ file where
      file.path : ("*\\AppData\\Local\\Temp\\*.dll", "*\\Users\\Public\\*.dll", "*\\Temp\\*.dll") and
      file.extension : "dll"
  ]
  [ process where
      process.name : ("OktaHyperdriveIntegration.exe", "OktaHyperdriveSetup.exe") and
      process.args : "*LoadFrom*"
  ]

Splunk SPL Query

index=windows sourcetype=WinRegistry
| search registry_path="*HKEY_CURRENT_USER*Okta*Hyperdrive*"
| table _time host user registry_path registry_value_name registry_value_data
| join type=inner host user _time [
    index=windows sourcetype=WinEventLog:Security
    | search EventCode=4688 (Process_Name="*OktaHyperdrive*")
    | rename Process_Name as process_name
    | table _time host user process_name CommandLine
]
| join type=inner host user _time [
    index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational
    | search EventCode=7 Image="*Okta*" ImageLoaded="*Temp*" OR ImageLoaded="*Public*"
    | rename Image as process_image, ImageLoaded as loaded_dll
    | table _time host user process_image loaded_dll
]
| where loaded_dll = "*\.dll" 
| eval threat = "CVE-2026-78574 - Okta Hyperdrive DLL Hijack"

Wazuh OSSEC Rule

<group name="okta_hyperdrive,">
  <rule id="785740" level="12">
    <decoded>
      <program_name>Microsoft-Windows-Sysmon/Operational</program_name>
    </decoded>
    <field name="win.system.eventID">^7$</field>
    <field name="win.eventdata.image">OktaHyperdrive.*\.exe</field>
    <field name="win.eventdata.imageLoaded">(AppData\\Local\\Temp|Users\\Public|Temp)\\.*\.dll</field>
    <description>CVE-2026-78574 - Okta Hyperdrive Integration plugin loaded unverified assembly from user-writable path</description>
    <group>okta_hyperdrive,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch, vendor fix, or advisory has been identified from any tracked source. The affected version range is unknown. Until Okta releases an update, the following measures are recommended.

1) Immediate Mitigations (compensating controls):

• Restrict interactive logon: Limit local user accounts to necessary personnel; enforce least-privilege and prevent standard users from accessing shared endpoints (kiosks, VDIs).
• Block user-writable assembly paths: Use Application Control (e.g., WDAC, AppLocker) to prevent DLLs from being loaded from %TEMP%, %PUBLIC%, and other user-writable locations by Okta processes. Apply explicit deny rules on the file paths commonly used for DLL planting.
• Harden the registry: Apply a restrictive ACL on HKEY_CURRENT_USER\Software\... keys referenced by Okta Hyperdrive (where determinable) to prevent writes by non-owner accounts, though note this is per-user hive and inherently user-writable.
• Monitor installation events: Do not run the Okta Hyperdrive installer from an elevated context on machines where unprivileged users could have pre-poisoned the registry. Stage and verify installer integrity before execution.

2) Patch/Upgrade Steps:

• Monitor Okta's security advisories and the vendor's plugin update channel. No fixed version is available; subscribe to vendor notifications for CVE-2026-78574.
• When a patch is released, prioritize deployment to endpoints where the plugin runs with delegated identity credentials or on shared workstations. Validate the new version enforces Authenticode or strong-name signature verification on Assembly.LoadFrom calls.

3) Long-Term Hardening:

• Enforce signed-assembly loading for all Okta-related plugins and any third-party .NET components via a common policy (WDAC / AppLocker publisher rules).
• Restrict installer execution: require local administrative approval or run installs from a clean, isolated administrative session.
• Segment identity-management workstations from general user endpoints to reduce the blast radius of the post-exploitation identity-token theft.
• Enable Sysmon (Event IDs 7, 11, 13) and centralize Windows registry/process logs to alert on user-hive registry modifications to Okta keys followed by DLL loads from non-standard paths.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-78574 (official CVE record — description, CVSS vector, CWE)
2. CWE-426 — Untrusted Search Path: https://cwe.mitre.org/data/definitions/426.html (weakness class reference)
3. MITRE ATT&CK — T1574 Hijack Execution Flow: https://attack.mitre.org/techniques/T1574/ (tactic mapping; includes sub-techniques for DLL search-order hijacking)
4. Okta Security Advisories (vendor): https://trust.okta.com/security-advisories/ (monitor for future patch notification — currently no mention of CVE-2026-78574)
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — not listed (verified NO), but monitor for updates if in-the-wild exploitation emerges

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None reported as of this report. No public PoC, Nuclei template, or exploit code exists. The EPSS score is not yet assigned by FIRST.org. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Analysts should nonetheless treat CVE-2026-78574 as a high-priority local-privilege-escalation and code-execution risk on Windows endpoints running the Okta Hyperdrive Integration plugin, given the ease of exploitation and the absence of a patch.