Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console.
Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values.
An attacker with administrative access can use those values to trigger command execution under the OAG service account. The disclosure does not describe an unauthenticated attack.
The flaw sits where administrative configuration input reaches processing functions inside the gateway. Instead of treating the supplied values strictly as configuration data, the affected software can allow crafted input to lead to system command execution.
Okta Access Gateway Flaw
Okta classifies the issue under CWE-94, improper control of code generation, and CWE-20, improper input validation. The required access is an important limit. An attacker must first gain administrative access to the OAG Admin Console.
A regular application account alone does not meet the stated conditions, and the advisory does not identify an authentication bypass that removes this requirement.
Successful exploitation runs commands with the permissions of the OAG service account. That is not the same as confirmed root access. The potential damage depends on what that account can read, change, or run, making its actual permissions important when assessing exposure.
The supplied CVSS v3.1 vector describes a network attack with low complexity, high required privileges, and no user interaction. It also assigns high impact to confidentiality, integrity, and availability, with changed scope.
Organizations running Okta Access Gateway versions before 2026.10.2 should upgrade to version 2026.10.2 or later. The supplied disclosure identifies that release as the fix and does not provide a separate workaround.
The patch follows earlier Okta Access Gateway and Auth0 security fixes covering authorization bypass, SQL injection, and stored cross-site scripting.
Those September issues had different requirements and fixes, so the earlier Access Gateway 2026.9.1 update does not meet this advisory’s minimum patched version.
Administrators should also review who can reach the management console and investigate unexpected configuration changes. Previous reporting on Okta administrator session abuse at 1Password shows why protecting privileged sessions matters, although that incident is separate from this vulnerability.
The supplied advisory does not report active exploitation, publish attack payloads, or identify the affected configuration field. Those gaps do not prove exploitation is impossible. Teams should prioritize the appliance upgrade and check Okta’s security advisory portal for further guidance as details become available.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
