Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands

What happened?

Okta has disclosed a critical security flaw in Okta Access Gateway that lets an authenticated administrator run system commands through the appliance’s Admin Console. Tracked as CVE-2026-115547, the vulnerability affects versions before 2026.10.2 and has a CVSS v3.1 score of 9.1, according to the October 22, 2026 advisory. The issue involves weak input validation when the Admin Console processes specially formatted configuration values. An attacker with administrative access can use those values to trigger command execution under the OAG service account.

Key details

• A critical flaw in Okta Access Gateway lets authenticated admins execute system commands via the Admin Console.
• The vulnerability is tracked as CVE-2026-115547 with a CVSS v3.1 score of 9.1.
• Weak input validation allows crafted configuration values to trigger command execution under the OAG service account.
• Exploitation requires administrative access to the OAG Admin Console; regular accounts are insufficient.
• Commands run with OAG service account permissions, not confirmed root access.
• Okta classifies the flaw under CWE-94 and CWE-20 for improper code generation control and input validation.
• The advisory does not report active exploitation, publish payloads, or identify the affected configuration field.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.