Okta has disclosed a critical vulnerability in Okta Access Gateway that allows an authenticated administrator to execute system commands through the appliance’s Admin Console.
Tracked as CVE-2026-115547, the issue affects versions earlier than 2026.10.2 and carries a CVSS v3.1 score of 9.1, according to an advisory published on October 22, 2026. The flaw stems from weak input validation when the Admin Console processes specially formatted configuration values.
An attacker who already has administrative access can supply those specially formatted values to trigger command execution under the OAG service account. The advisory does not describe any unauthenticated attack vector.
Okta Access Gateway Flaw
Okta classifies the vulnerability under CWE-94 (improper control of code generation) and CWE-20 (improper input validation). A key limitation is the required access: an attacker must first obtain administrative access to the OAG Admin Console.
A regular application account alone does not meet the conditions for exploitation, and the advisory does not disclose an authentication bypass that would remove the administrative access requirement.
If successfully exploited, commands run with the privileges of the OAG service account. That is distinct from confirmed root access; the potential impact depends on the permissions granted to that service account and what it can read, modify, or execute.
The published CVSS v3.1 vector characterizes the issue as a network attack with low complexity, high required privileges, and no user interaction, and assigns high impact to confidentiality, integrity, and availability with changed scope.
Organizations using Okta Access Gateway releases prior to 2026.10.2 should upgrade to version 2026.10.2 or later. Okta identifies that release as the fix and does not offer a separate workaround in the advisory.
This patch builds on earlier Okta Access Gateway and Auth0 fixes that addressed authorization bypasses, SQL injection, and stored cross-site scripting. Those September fixes had different requirements and remediation, so the prior Access Gateway 2026.9.1 update does not satisfy the minimum patched version for this advisory.
Administrators are advised to review who can reach the management console and to investigate any unexpected configuration changes. Past reporting on Okta administrator session abuse at 1Password illustrates the importance of protecting privileged sessions, although that incident is separate from this vulnerability.
The advisory does not report active exploitation, publish attack payloads, or identify the specific affected configuration field. Those omissions do not prove exploitation is impossible. Teams should prioritize upgrading the appliance and monitor Okta’s security advisory portal for further guidance as additional details are released.
Update defenses against new malware as soon as it appears. Integrate TI feeds with data from 16K SOCs.
