Critical severity · published Oct 23, 2026
CVE-2026-115547
Command Execution via Admin Console Input in Okta Access Gateway
New
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Okta Access Gateway · Okta
before 2026.10.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115547
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115547
trust.okta.com
http://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547
More from Okta Access Gateway
9.9
CVE-2026-78623
Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
8.1
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gateway
7.2
CVE-2026-78550
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
7.2
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Application Label Configuration
6.7
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing