Okta Access Gateway CVE-2026-115547 lets authenticated admins run system commands via Admin Console (CVSS 9.1)
A command injection vulnerability, CVE-2026-115547, affects Okta Access Gateway (OAG) appliances released before 2026.10.2. An authenticated administrator can submit specially formatted configuration values through the Admin Console and execute system commands. The advisory dated October 22, 2026 rates it CVSS v3.1 9.1. It reports no active exploitation, no named threat actor and no public exploit code. Because the flaw requires administrative access, it is not an unauthenticated RCE, but it turns privileged console access into OS command execution.
Entenda a falha
A vulnerabilidade
CVE-2026-115547 is a command injection flaw (CWE-94, with CWE-20) in the Admin Console of Okta Access Gateway (OAG) appliances. It is rated CVSS v3.1 9.1. An attacker needs network reach to the console and an authenticated administrator account, with no user interaction. They can then run system commands as the OAG service account. Versions before 2026.10.2 are affected, and 2026.10.2 or later fixes it. The advisory does not confirm root, so the real impact depends on that account's permissions and the appliance configuration.
Como funciona
An administrator submits configuration values through the OAG Admin Console. The appliance processes these values on the server side. When a value is specially formatted, the processing path ends up running it as system commands instead of treating it as plain data. The commands run under the OAG service account. The advisory does not say which configuration field is involved or how the command is invoked.
Por que é vulnerável
The root cause is insufficient validation of configuration values handled by the administrative interface. The input is not checked or neutralized before it reaches a code or command execution path, which matches CWE-94 and CWE-20. The fix is in 2026.10.2, but the articles do not describe what it changes in the code.
Como foi descoberta
The articles do not say who found the flaw or how. The flaw was disclosed in an advisory dated October 22, 2026, which also names 2026.10.2 as the fixed release. The advisory reports no known active exploitation, no named threat actor and no public exploit code.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 10:17.
Detalhes técnicos
- The root cause is insufficient validation of configuration values processed by the administrative interface. The advisory classifies it as code injection (CWE-94) with CWE-20 (Improper Input Validation).
- Commands run in the context of the OAG service account. The advisory does not confirm root privileges, so the impact depends on that account's permissions and the appliance configuration.
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. It indicates network exploitation, low complexity, high privileges required, no user interaction, and changed scope. - The advisory does not specify the affected configuration field, an example payload, or how the command is invoked.
Remediação
- Upgrade all OAG appliances to version 2026.10.2 or later. Earlier versions remain vulnerable.
- Verify deployed appliance versions and prioritize the upgrade.
- Review administrative access and investigate unexpected configuration changes. These steps do not replace installing the fixed release.
Linha do tempo
-
Okta Access Gateway CVE-2026-115547 lets authenticated admins run system commands via Admin Console (CVSS 9.1)
ler a análise desta fonte ocultar
A command injection vulnerability, CVE-2026-115547, affects Okta Access Gateway (OAG) appliances released before 2026.10.2. An authenticated administrator can submit specially formatted configuration values through the Admin Console and execute system commands. The advisory dated October 22, 2026 rates it CVSS v3.1 9.1. It reports no active exploitation, no named threat actor and no public exploit code. Because the flaw requires administrative access, it is not an unauthenticated RCE, but it turns privileged console access into OS command execution.
Technical Details
- The root cause is insufficient validation of configuration values processed by the administrative interface. The advisory classifies it as code injection (CWE-94) with CWE-20 (Improper Input Validation).
- Commands run in the context of the OAG service account. The advisory does not confirm root privileges, so the impact depends on that account's permissions and the appliance configuration.
- CVSS vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. It indicates network exploitation, low complexity, high privileges required, no user interaction, and changed scope. - The advisory does not specify the affected configuration field, an example payload, or how the command is invoked.
Remediation
- Upgrade all OAG appliances to version 2026.10.2 or later. Earlier versions remain vulnerable.
- Verify deployed appliance versions and prioritize the upgrade.
- Review administrative access and investigate unexpected configuration changes. These steps do not replace installing the fixed release.