CVE-2021-28113

trust.okta.com • October 24, 2026

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway in version 2020.8.4 and earlier allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account.

Affected product and versions

Okta Access Gateway version 2020.8.4 and earlier

The vulnerability is fixed in Okta Access Gateway version 2020.9.3 and newer. To remediate this vulnerability upgrade Okta Access Gateway.

Vector string:AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:H/RL:U/RC:C

Okta would like to thank Jeremy Brown for responsibly reporting this vulnerability.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Okta Patches Critical Command Execution Flaw in Access Gateway Okta has released patches for critical vulnerabilities in the Okta Access Gateway, including CVE-2026-115547, which allows authenticated administrators to execute system commands via input validation flaws. This vulnerability, rated 9.1 on the CVSS scale, affects all versions prior to 2026.10.2. Another flaw, CVE-2026-115546, allows an authenticated user to bypass authentication source verification, rated 8.1. Both vulnerabilities require administrative access to exploit. Okta's advisories do not report any in the wild but recommend immediate upgrades to version 2026.10.2 or later. The updates also address PHP2Shell vulnerabilities affecting OAG appliances running PHP 8.3.x. The flaws were disclosed on October 22, 2026, and the patches were made available on October 23, 2026. 1 sources 73

Extracted Entities

CVE-2021-28113

The full story

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)