Medium severity · published Sep 8, 2026
CVE-2026-78624
Improper Path Validation in Okta Access Gateway Backup and Restore Functionality
4.9
CVSS
0.5%
EPSS
No
On KEV
Description
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Okta Access Gateway · Okta
before 2026.9.1 · source: vendor
AG
Access Gateway · Okta
before 2026.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78624
Vendor Advisory
https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624
More from Okta Access Gateway
9.9
CVE-2026-78623
Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
9.1
CVE-2026-115547
Command Execution via Admin Console Input in Okta Access Gateway
8.1
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gateway
7.2
CVE-2026-78550
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
7.2
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Application Label Configuration