Okta Access Gateway before 2026.10.2 allows admin command execution
Original title: Critical Okta Access Gateway Vulnerability Enables Remote Command Execution
CVE-2026-115547 is scored 9.1 but needs Admin Console privileges, and the advisory reports no known exploitation.
An October 22, 2026 advisory says Okta Access Gateway appliances before 2026.10.2 let an authenticated administrator run system commands by submitting specially formatted configuration values in the Admin Console. The flaw, CVE-2026-115547, is scored CVSS 9.1 and is described as code injection tied to CWE-94 and CWE-20. Commands run as the OAG service account; the advisory does not say they run as root. Okta does not report active exploitation or public exploit code. The fix is version 2026.10.2 or later.
Unconfirmed: The advisory does not confirm root execution or name the vulnerable configuration field.
- The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
- High privileges are required and no user interaction is needed.
- The affected configuration field and an example payload are not disclosed.
- Reviewing admin access does not replace installing 2026.10.2.
Impact: Authenticated admin can run OS commands as the OAG service account
| Product | Affected | Fixed in |
|---|---|---|
| Okta Access Gateway | before 2026.10.2 | 2026.10.2 |
- 1.Upgrade Okta Access Gateway appliances to version 2026.10.2 or later.
- 2.Review administrative access and unexpected configuration changes.
- CVEs
- CVE-2026-115547
- Vendors
- Okta
- Products
- Okta Access Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115547 | Authenticated command injection in Okta Access Gateway Admin Console | 9.1 | — |
From the original article
2 min read at gbhackers.com
A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could allow an authenticated administrator to execute system commands by submitting specially formatted configuration values through the appliance’s Admin Console. This vulnerability is documented in an advisory dated October 22, 2026. Tracked as CVE-2026-115547, the issue affects versions of the OAG […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.