Okta Patches Critical Access Gateway Flaw CVE-2026-115547

Okta has released an update for Okta Access Gateway that fixes a critical vulnerability allowing an authenticated administrator to execute system commands on the appliance.

The flaw is tracked as CVE-2026-115547 and carries a CVSS score of 9.1. It affects the OAG Admin Console in all appliance versions before 2026.10.2, according to an advisory Okta published on Thursday.

Okta Access Gateway is an on-premises appliance that extends Okta sign-on and access policies to web applications hosted in an organisation’s own infrastructure. The Admin Console is where administrators configure the gateway and the applications behind it.

The bug is an input validation issue. The console accepts specially formatted configuration values and processes them without proper checks. An administrator can place a crafted value in a configuration field, and when the gateway processes it, system commands run in the context of the OAG service account. Okta classifies the issue as code injection under CWE-94 and CWE-20.

“An authenticated administrator can leverage this to execute system commands,” Okta said.

The attack requires high privileges, yet the flaw still scores 9.1. It can be exploited over the network with low complexity, and the CVSS vector marks the scope as changed, meaning the impact reaches beyond the vulnerable component itself. Confidentiality, integrity and availability are all rated high. A similar admin-only command injection in OAG, CVE-2021-28113 , was rated 6.7 in 2021.

The same release fixes CVE-2026-115546 , an authentication bypass rated 8.1. The gateway does not validate which authentication source a user selects during sign-on. A user with an active session can change that parameter, which may generate a SAML assertion that grants access to the Admin Console.

The only precondition for that flaw is a valid session on any authentication source configured on the gateway. CVE-2026-115547, in turn, requires Admin Console access. Okta’s advisories do not describe the two being used together.

Okta also published a third advisory on the same day. It covers PHP2Shell, the name for two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) that the PHP project disclosed on October 21. OAG appliances running PHP 8.3.x before 8.3.36 are affected. Okta said the gateway’s default configuration mitigates known exploitation and recommends upgrading to OAG 2026.44.0, which ships PHP 8.3.36.

The October fixes come six weeks after Okta’s September 8 batch of 11 OAG advisories , all resolved in version 2026.9.1. That batch included CVE-2026-78630 , an SNMP configuration flaw that allowed OS commands to run with root privileges. It also included CVE-2026-78625 , a code injection through dashboard application labels.

Okta’s latest advisories make no mention of exploitation in the wild, credit no researcher and list no workaround. To remediate the Admin Console flaws, Okta advises upgrading the appliance to version 2026.10.2 or later. For the PHP2Shell issues, the target is 2026.44.0.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!