CVE-2026-115547

Command Execution via Admin Console Input in Okta Access Gateway

State: Published
Severity: 9.1 Critical
Published: Oct 23, 2026
Updated: Oct 23, 2026
Reserved: Oct 22, 2026

Description

An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	Okta

Weaknesses

CWE-94 Improper Control of Generation of Code
CWE-20 Improper Input Validation

Affected Products

Product	Versions
Okta Access GatewayOkta	before 2026.10.2Affected

References

http://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.