Okta Access Gateway before 2026.10.2 allows admin command execution
Original title: Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
CVE-2026-115547 scores 9.1 but needs Admin Console access; Okta reports no active exploitation and no workaround.
Okta disclosed CVE-2026-115547 in Okta Access Gateway versions before 2026.10.2. An authenticated administrator can submit specially formatted configuration values in the Admin Console and run system commands as the OAG service account. Okta maps the issue to CWE-94 and CWE-20. The October 22 advisory does not describe an unauthenticated path, publish payloads, or report active exploitation. The fix is 2026.10.2 or later; the earlier 2026.9.1 update does not meet this advisory.
Unconfirmed: The advisory does not report active exploitation, payloads, or the affected configuration field.
- CVSS v3.1 is 9.1: network, low complexity, high privileges, changed scope.
- A regular application account does not meet the stated conditions.
- Command execution uses the OAG service account, not confirmed root.
- The advisory does not name the affected configuration field.
- Administrators should review console access and unexpected configuration changes.
Impact: authenticated admin command execution as the OAG service account
| Product | Affected | Fixed in |
|---|---|---|
| Okta Access Gateway | before 2026.10.2 | 2026.10.2 or later |
- 1.Upgrade Okta Access Gateway to 2026.10.2 or later.
- 2.Review who can reach the Admin Console and unexpected configuration changes.
- 3.Check Okta’s security advisory portal for further guidance.
- CVEs
- CVE-2026-115547
- Vendors
- Okta
- Products
- Okta Access Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-115547 | Authenticated command injection in Okta Access Gateway Admin Console | 9.1 | — |
From the original article
2 min read at cybersecuritynews.com
Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026. 10.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.