Okta Access Gateway

Search everything

Mentions · 7d0
Mentions · 30d3
All mentions5
First seenSep 11, 2026
Last mentioned8d ago

Timeline

5 articles · newest first

Okta Access Gateway before 2026.10.2 allows admin command execution

CVE-2026-115547 scores 9.1 but needs Admin Console access; Okta reports no active exploitation and no workaround.

Cyber Security NewsOct 23, 15:19 UTC · 8d agoVulnerabilityCVE-2026-1155471 · 1 read

Okta Access Gateway before 2026.10.2 allows admin command execution

CVE-2026-115547 is scored 9.1 but needs Admin Console privileges, and the advisory reports no known exploitation.

GBHackersOct 23, 12:29 UTC · 8d agoVulnerabilityCVE-2026-1155471 · 1 read

Okta cloud unaffected by PHP2Shell; Access Gateway needs patch

Okta is still investigating CVE-2026-109618 and CVE-2026-109619, with on-prem remediation unfinished.

Okta SecurityOct 22, 00:00 UTC · 9d agoAdvisory 2 sourcesCVE-2026-109618 CVE-2026-1096192 · 1 read

Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.

GBHackersSep 11, 09:42 UTC · Sep 11, 2026VulnerabilityCVE-2026-85982 CVE-2026-78626 CVE-2026-786237

Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.

Cyber Security NewsSep 11, 08:13 UTC · Sep 11, 2026VulnerabilityCVE-2026-85982 CVE-2026-78626 CVE-2026-786235 · 1 read

Related CVEs

by mentions

CVE-2026-78623<1%9.9
SQL Injection in Okta Access Gateway via Unsanitized SAML Assertion Values
published Sep 8, 2026Okta Access Gateway
CVE-2026-1155479.1
Authenticated command injection in Okta Access Gateway Admin Console
published 8d agoOkta Access Gateway (OAG) Admin Console
CVE-2026-85982<1%9.0
Stored XSS in Auth0 AD/LDAP Connector Admin Panel
published Sep 8, 2026Okta (Auth0) Auth0 AD/LDAP Connector
CVE-2026-78626<1%6.5
Authorization Bypass in Okta Access Gateway Protected Rule Checks
published Sep 8, 2026Okta Access Gateway
CVE-2026-109619100%9.2
Use-after-free RCE in PHP via stale request globals
published 10d agophpKEVPoC ×15
CVE-2026-109618100%9.2
OOM longjmp memory flaw enabling RCE in PHP
published 10d agophpKEVPoC ×25

Appears with

Oktavendor · 5
Auth0 AD/LDAP Connectorproduct · 2
Auth0vendor · 2
Oktaorganization · 2
Auth0product · 1

Entities are extracted by the model from each article. First seen Sep 11, 2026, last mentioned 8d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.