CVE-2026-78624
Improper Path Validation in Okta Access Gateway Backup and Restore Functionality
- State
- Published
- Severity
- 4.9 Medium
- Published
- Sep 8, 2026
- Updated
- Sep 10, 2026
- Reserved
- Aug 24, 2026
Description
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | Okta |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Affected Products
| Product | Versions |
|---|---|
Okta Access GatewayOkta |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.