CVE-2026-115547
Command Execution via Admin Console Input in Okta Access Gateway
Okta Okta Access GatewayIdentity & access
CVSS
9.1CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2026.10.2Okta Access GatewayCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
Text from CVE List
Affected versions 1
- Okta Access Gatewayaffected: all versions before 2026.10.2CVE List