Critical Okta Access Gateway Vulnerability Enables Remote Command Execution

A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could allow an authenticated administrator to execute system commands by submitting specially formatted configuration values through the appliance’s Admin Console. This vulnerability is documented in an advisory dated October 22, 2026.

Tracked as CVE-2026-115547, the issue affects versions of the OAG appliance released before 2026.10.2. The advisory assigns this vulnerability a CVSS v3.1 score of 9.1, indicating its severity, and highlights version 2026.10.2 as the release that includes the necessary fix.

Exploiting this vulnerability requires administrative access to the OAG Admin Console. This requirement distinguishes it from unauthenticated remote command execution vulnerabilities, as an attacker must already possess the necessary administrative privileges to trigger the vulnerable configuration processing.

Critical Okta Access Gateway Vulnerability

The weakness stems from insufficient validation of configuration values processed through the administrative interface. An authenticated administrator can provide specially formatted input that executes system commands in the context of the OAG service account.

The advisory classifies this vulnerability as a code injection flaw. It associates it with CWE-94 (Improper Control of Code Generation) and CWE-20 (Improper Input Validation).

The advisory does not specify the affected configuration field, provide an example payload, or describe how the command is invoked. Additionally, it does not confirm whether successful exploitation grants root privileges; the execution context is specifically tied to the OAG service account.

This distinction is important when assessing potential consequences. The commands an attacker can run, the resources they can exploit, and opportunities for further compromise depend on the permissions assigned to that account and the appliance’s overall configuration.

The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The metrics indicate network-based exploitation with low attack complexity, high privileges required, and no additional user interaction.

The vector also reflects a changed scope and significant potential impacts on confidentiality, integrity, and availability, according to the CVSS v3.1 framework.

While the need for administrative access limits who can initiate exploitation, it does not reduce the vulnerability’s seriousness, as it allows execution of operating-system commands through an application management interface.

The advisory does not report any known active exploitation, identify a specific threat actor, or reference publicly available exploit code. Such details should remain unconfirmed rather than assumed based solely on the critical severity rating.

The recommended remediation is to upgrade all affected Okta Access Gateway appliances to version 2026.10.2 or later. Versions before this release remain vulnerable, as the advisory states.

Security teams should verify the deployed appliance versions and prioritize the upgrade. Additional defensive measures include reviewing administrative access and investigating unexpected configuration changes. However, these do not replace installing the fixed release.

The primary concern is the transition from privileged console access to command execution under the service account. Remediation efforts should focus on fixing the vulnerable processing path rather than assuming administrative users are inherently trusted within the organization’s security framework.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.