CVE-2026-77585Improper Validation of SSH Target in Okta Privileged Access Client

Description

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://trust.okta.com/security-advisories/improper-validation-ssh-target-in-okta-privileged-access-client-cv…