Live › vulnerability › CVE-2026-115547
Go to dashboardAn input validation flaw in the Okta Access Gateway Admin Console lets specially formatted configuration values be processed as commands. An authenticated administrator can run system commands as the OAG service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Okta Access Gateway | vendor | < 2026.10.2 | 2026.10.2 |
Check the installed OAG version in the Admin Console and confirm it is below 2026.10.2.
Upgrade Okta Access Gateway to 2026.10.2 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
This page as .md · .json · in your agent: get_signal("CVE-2026-115547")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.