Medium severity · published Sep 8, 2026
CVE-2026-78625
Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Okta Access Gateway · Okta
before 2026.9.1 · source: vendor
AG
Access Gateway · Okta
before 2026.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78625
Vendor Advisory
https://trust.okta.com/security-advisories/insufficient-validation-of-dashboard-application-labels-in-okta-access-gateway-dashboard-site-configuration-cve-2026-78625
More from Okta Access Gateway
9.9
CVE-2026-78623
Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
9.1
CVE-2026-115547
Command Execution via Admin Console Input in Okta Access Gateway
8.1
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gateway
7.2
CVE-2026-78550
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
7.2
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Application Label Configuration