Okta Access Gateway before 2026.10.2 allows admin command execution
CVE-2026-115547 is scored 9.1 but needs Admin Console privileges, and the advisory reports no known exploitation.
64
CVE-2026-115547
Authenticated command injection in Okta Access Gateway Admin Console
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An input validation flaw in the Okta Access Gateway Admin Console lets specially formatted configuration values be processed as code. An authenticated administrator can reach the console over the network, without user interaction, and run system commands as the OAG service account. Deployments that expose the Admin Console to administrators are affected. Okta has not listed affected builds.
What to do: Apply Okta's update for CVE-2026-115547. No workaround is named.
| Product | Affected |
|---|---|
| Okta Access Gateway (OAG) Admin Console | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
- Weakness
- CWE-20, CWE-94
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
In the news
2 storiesOkta Access Gateway before 2026.10.2 allows admin command execution
CVE-2026-115547 scores 9.1 but needs Admin Console access; Okta reports no active exploitation and no workaround.
62