Medium severity · published Sep 8, 2026
CVE-2026-78630
Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Okta Access Gateway · Okta
before 2026.9.1 · source: vendor
AG
Access Gateway · Okta
before 2026.9.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78630
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78630
Vendor Advisory
https://trust.okta.com/security-advisories/improper-input-neutralization-in-okta-access-gateway-snmp-configuration-processing-cve-2026-78630
More from Okta Access Gateway
9.9
CVE-2026-78623
Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
9.1
CVE-2026-115547
Command Execution via Admin Console Input in Okta Access Gateway
8.1
CVE-2026-115546
Authentication Source Verification Issue in Okta Access Gateway
7.2
CVE-2026-78550
Improper Input Handling in Okta Access Gateway Management Console Exception Handler
7.2
CVE-2026-78545
Improper Input Sanitization in Okta Access Gateway Application Label Configuration