Okta Access Gateway flaw lets an admin run system commands as the gateway's service account

Okta published a security advisory on October 22 for CVE-2026-115547 in Okta Access Gateway (OAG), the on-premises appliance that puts Okta sign-in in front of header-based and legacy web apps. An input validation flaw in the Admin Console processes specially formatted configuration values, which lets an authenticated administrator run system commands under the OAG service account. Okta classifies it as code injection (CWE-94 and CWE-20) and scores it CVSS 9.1, with a changed scope. All appliance versions before 2026.10.2 are affected, and the fix is 2026.10.2 or later; reporting notes the earlier 2026.9.1 update does not meet that bar. The attack requires high privileges, and Okta's advisory does not report exploitation.

Why it matters

The changed scope is the point. An OAG admin should configure the gateway; this bug turns that role into code execution on the appliance that signs users in to every app behind it. Anyone who phishes or reuses an OAG admin credential can go from configuration access to a foothold on an appliance that sits in the sign-in path.

Upgrade OAG to 2026.10.2 or later. List who holds OAG Admin Console access, cut it to the people who need it, and protect those accounts with phishing-resistant MFA. Keep the admin console off general networks. Review the appliance's admin logs for configuration changes you cannot explain, and treat the gateway as tier-zero alongside the IdP it fronts.

Source: Okta