Okta Access Gateway flaw lets an admin run system commands as the gateway's service account
Okta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute system commands as the OAG service account. CVSS 9.1; fixed in 2026.10.2.
Okta published a security advisory on October 22 for CVE-2026-115547 in Okta Access Gateway (OAG), the on-premises appliance that puts Okta sign-in in front of header-based and legacy web apps. An input validation flaw in the Admin Console processes specially formatted configuration values, which lets an authenticated administrator run system commands under the OAG service account. Okta classifies it as code injection (CWE-94 and CWE-20) and scores it CVSS 9.1, with a changed scope. All appliance versions before 2026.10.2 are affected, and the fix is 2026.10.2 or later; reporting notes the earlier 2026.9.1 update does not meet that bar. The attack requires high privileges, and Okta's advisory does not report exploitation.
Why it matters
The changed scope is the point. An OAG admin should configure the gateway; this bug turns that role into code execution on the appliance that signs users in to every app behind it. Anyone who phishes or reuses an OAG admin credential can go from configuration access to a foothold on an appliance that sits in the sign-in path.
Upgrade OAG to 2026.10.2 or later. List who holds OAG Admin Console access, cut it to the people who need it, and protect those accounts with phishing-resistant MFA. Keep the admin console off general networks. Review the appliance's admin logs for configuration changes you cannot explain, and treat the gateway as tier-zero alongside the IdP it fronts.
Source: Okta
Related on Start with Identity
- BlogLangflow flaws let attackers bypass authentication and run code; only 1.13.0 fixes them
IBM's October 28 bulletin covers four Langflow flaws in every release from 1.0.0 to 1.12.8, including CVE-2026-93680, a 9.8-rated authentication bypass a public
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- BlogDocker Hub GhostPat flaw let account conversion hand access tokens to any victim
CVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owne
- GlossaryAuthorization (AuthZ)
Authorization (AuthZ) is the decision to permit or deny an authenticated subject access to a resource or action, and the rights that result; NIST's glossary, ci
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,