CVE-2026-78622 in Verify
Summary
by MITRE • 09/09/2026
The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
This vulnerability represents a critical privilege escalation and arbitrary file deletion flaw within the Okta Verify for Windows application uninstaller component. The core technical deficiency lies in the failure to validate whether the user data directory path points to a filesystem junction or symbolic link before initiating removal operations with elevated administrative privileges. In Microsoft Windows operating systems, junctions are reparse points that allow one directory to act as an alias for another location on the same volume or across different volumes. When software performs recursive deletion of a directory without verifying its nature, it blindly follows these links into their target locations. Consequently, instead of deleting only the intended local application data, the uninstaller traverses the junction and proceeds to delete files in the external target directory with system-level permissions.
The operational impact of this flaw is severe, potentially leading to catastrophic data loss for end-users and system instability. An attacker who can influence or predict the location of the user data directory could create a malicious filesystem junction pointing to critical system directories such as Windows\System32, Program Files, or sensitive user personal folders like Documents or Desktop. When the victim runs the uninstaller with elevated privileges, which is standard for application removal processes, the tool will recursively delete all contents within these targeted external locations. This results in the permanent destruction of operating system files, installed applications, and valuable user data that are unrelated to the Okta Verify software itself. The lack of path canonicalization or junction detection bypasses standard safety mechanisms designed to prevent accidental deletion outside the intended scope.
From a vulnerability classification perspective, this issue aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-78: OS Command Injection in terms of its mechanism of following external references without validation. It also relates to CWE-436: Interpretation Error as the application misinterprets the directory structure by treating junctions as standard local directories. In the context of the MITRE ATT&CK framework, this behavior facilitates Defense Evasion through file deletion and potentially impacts Availability via destructive actions. The vulnerability exploits the trust relationship between the uninstaller and the operating system's filesystem abstraction layer, leveraging the elevated privileges granted during installation or removal to execute unintended side effects on unrelated parts of the disk structure.
Mitigation strategies must focus on implementing robust path validation before any recursive file operations are executed. Developers should utilize Windows API functions such as GetFileAttributesEx with FILE_ATTRIBUTE_REPARSE_POINT flags to detect junctions and symbolic links explicitly. If a reparse point is detected, the uninstaller should either abort the deletion process or prompt for explicit user confirmation after clearly identifying the target location outside the expected scope. Additionally, implementing strict allow-listing of directories that can be deleted during uninstallation ensures that only specific, known-safe paths are accessible to the removal routine. Regular security audits and static code analysis focused on filesystem interaction patterns are essential to identify similar flaws in other components of the application suite.