CVE-2026-115547: RCE in Okta Access Gateway Admin Console

Insufficient input validation in Okta OAG allows RCE with system privileges. CVSS 9.1 critical.

CVE-2026-115547 is an input validation flaw in the Okta Access Gateway (OAG) Admin Console. An authenticated administrator can provide specially formatted configuration values to execute system commands within the OAG service account context. OAG is a critical component for access control and authentication in enterprise infrastructure.

The vulnerability is classified as critical with CVSS 9.1. It requires administrative authentication but enables escalation to system privileges. A patch has been reported as available in specialized security media. The potential impact is high for any organization dependent on OAG for access management to critical resources.

IT teams must contact Okta to verify official patch availability. In the meantime: restrict physical and remote access to the Admin Console to explicitly authorized administrators; audit OAG logs for unusual changes or anomalous command execution; monitor OAG service behavior for unexpected processes.

At a glance

What: Input validation issue in Okta Access Gateway Admin Console allowing specially formatted configuration values to trigger system command execution within the OAG service account context.
Severity: CVSS 9.1 (Critical)
Affected versions: not reported
Fix: not reported (check official Okta advisory)
Status: Patch reported as available in specialized security media
Action: Restrict Admin Console access to authorized administrators; audit OAG logs for unusual changes; monitor process execution; contact Okta for official patch.

Sources: NVD, CVE-2026-115547

← All articles