CVE-2026-115546

trust.okta.com • October 24, 2026

Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.

Affected product and versions

Customers using the Okta Access Gateway versions prior to 2026.10.2 are affected.

A user holds a valid session for any authentication source configured on the gateway.

Customer Recommendations

To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.

The vulnerability is present in Okta Access Gateway versions prior to 2026.10.2 and is resolved in version 2026.10.2.

Authentication Bypass

CWE-639 (Authorization Bypass Through User-Controlled Key)

CWE-287 (Improper Authentication)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Okta Patches Critical Command Execution Flaw in Access Gateway Okta has released patches for critical vulnerabilities in the Okta Access Gateway, including CVE-2026-115547, which allows authenticated administrators to execute system commands via input validation flaws. This vulnerability, rated 9.1 on the CVSS scale, affects all versions prior to 2026.10.2. Another flaw, CVE-2026-115546, allows an authenticated user to bypass authentication source verification, rated 8.1. Both vulnerabilities require administrative access to exploit. Okta's advisories do not report any in the wild but recommend immediate upgrades to version 2026.10.2 or later. The updates also address PHP2Shell vulnerabilities affecting OAG appliances running PHP 8.3.x. The flaws were disclosed on October 22, 2026, and the patches were made available on October 23, 2026. 1 sources 73

Extracted Entities

CVE-2026-115546

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (2)

Platforms (1)

Vulnerabilities (1)