Okta Access Gateway: Command execution via Admin Console input
Summary
Okta Access Gateway (OAG) appliances before version 2026.10.2 contain an input validation flaw in the Admin Console that lets specially formatted configuration values be processed as system commands. An authenticated administrator can use this to run commands in the context of the OAG service account, which can affect the gateway that sits in front of internal applications. Exploitation requires valid administrator access to the Admin Console.
Affected
- Okta Access Gateway appliance versions prior to 2026.10.2 (VulDB lists the range up to 2026.10.1)
- Default configuration: unaffected according to the CVE record
- The 2026.9.1 release does not meet the minimum patched version
Fixed in
- Upgrade to Okta Access Gateway 2026.10.2 or later
- Okta recommends 2026.44.0, which also fixes the related PHP runtime CVE-2026-109618 and CVE-2026-109619
Workaround
- No vendor workaround documented. Upgrading is the remediation.
Exploitation
- The Okta advisory reports no known exploitation.
- A secondary report states that CISA rates exploitation as none; this has not been verified on a CISA page.
- No public proof-of-concept exploit found in the sources reviewed.
- Related PHP flaws CVE-2026-109618 and CVE-2026-109619 are reported as exploited in a secondary source.
Our recommendation
- Upgrade all OAG appliances to 2026.10.2 or later, or to 2026.44.0 to also cover the PHP fixes. Check the current version first.
- Treat appliances below 2026.10.2 with a reachable Admin Console as high priority.
- Review and reduce Admin Console accounts, and restrict management access to trusted IP ranges.
- Review OAG admin and configuration logs for unexpected changes.
- Do not assume that a September 2026 patch covers this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Okta Security Advisory CVE-2026-115547 trust.okta.com
- VulDB CVE-2026-115547 vuldb.com
- VulDB 425555 vuldb.com
- Cyberkendra analysis CVE-2026-115547 www.cyberkendra.com
- SecurityOnline PHP2Shell and Okta Access Gateway vulnerabilities securityonline.info
- GBHackers critical Okta Access Gateway vulnerability gbhackers.com
- SQ Magazine Okta Access Gateway CVE-2026-115547 sqmagazine.co.uk
- Rescana CVE-2026-115547 impact and mitigation www.rescana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:27.
Original description (NVD)
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.