Critical Okta Access Gateway Flaw Allows Admin-Privilege Command Execution

Okta has alerted customers to a critical security vulnerability affecting its Okta Access Gateway (OAG) product. The flaw, identified as CVE-2026-115547, allows an authenticated administrator with access to the OAG Admin Console to execute arbitrary system commands. The vulnerability carries a CVSS v3.1 score of 9.1, underscoring its severity.

The root cause of the issue lies in insufficient input validation within the Admin Console. When processing specially crafted configuration values, the affected versions of Okta Access Gateway can be tricked into executing commands. This means that an attacker who has already gained administrative privileges within the OAG environment can leverage this weakness to escalate their control to the underlying system.

It is important to note that this vulnerability requires prior administrative access to the OAG Admin Console. It does not appear to be exploitable by unauthenticated attackers or those with only standard application user privileges. The commands are executed with the permissions of the OAG service account, which, while not necessarily full root access, can still pose a significant risk depending on the privileges assigned to that account.

Okta has classified the vulnerability under CWE-94 (Improper Control of Code Generation) and CWE-20 (Improper Input Validation). The CVSS vector indicates a network-exploitable attack with low complexity, high privilege requirements, and no user interaction needed once administrative access is obtained. The impact on confidentiality, integrity, and availability is rated as high, with a changed scope.

To mitigate this risk, organizations running Okta Access Gateway versions prior to 2026.10.2 are strongly advised to upgrade to version 2026.10.2 or a later release. This version is identified as containing the fix for CVE-2026-115547. Okta has not provided a separate workaround for this specific vulnerability.

This critical flaw follows a series of other security updates for Okta Access Gateway and Auth0 products in recent months, which addressed issues such as authorization bypass, SQL injection, and stored cross-site scripting. Administrators should ensure they are applying the latest patches and also review access controls for their management consoles.

While Okta's advisory does not currently report active exploitation or provide specific attack payloads, the absence of such details does not preclude potential exploitation. Security teams should prioritize the upgrade and remain vigilant for any further guidance or updates from Okta regarding this vulnerability. Proactive patching and robust access management remain key defenses against such threats.