Input Validation Flaw in Okta Access Gateway Admin Console
CVE-2026-115547

9.1CRITICAL

Key Information:

Vendor

Okta

Status
Okta Access Gateway
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115547?

An input validation issue within the Okta Access Gateway Admin Console permits the processing of specially formatted configuration values. This vulnerability enables an authenticated administrator to execute arbitrary system commands under the privileges of the OAG service account, potentially compromising the integrity and security of the system.

Affected Version(s)

Okta Access Gateway 0 < 2026.10.2

References

http://trust.okta.com/security-advisories/command-executi...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.