{"id":"CVE-2026-115547","kind":"vulnerability","aliases":["CVE-2026-115547"],"related":[],"title":"Okta Access Gateway: admin console input flaw runs system commands","description":"An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.","summary":"An input validation flaw in the Okta Access Gateway Admin Console lets specially formatted configuration values be processed as commands. An authenticated administrator can run system commands as the OAG service account.","severity":"critical","cvss":9.1,"epss":0.00444,"exploited":false,"exploited_at":null,"products":[{"name":"Okta Access Gateway","fixed":["2026.10.2"],"affected":"< 2026.10.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["command-injection","infrastructure","okta-access-gateway","self-hosted","vendor"],"not_affected_if":["already-on-2026.10.2","managed-hosting"],"how_to_check":"Check the installed OAG version in the Admin Console and confirm it is below 2026.10.2.","fix":"Upgrade Okta Access Gateway to 2026.10.2 or later.","status":"open","published_at":"2026-10-23T04:18:16+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:35+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:31:35Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Okta Access Gateway to 2026.10.2 or later.","reach":"network","title":"Okta Access Gateway: admin console input flaw runs system commands","impact":"high","summary":"An input validation flaw in the Okta Access Gateway Admin Console lets specially formatted configuration values be processed as commands. An authenticated administrator can run system commands as the OAG service account.","category":"vendor","who_cares":["okta-access-gateway","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Commands run as the OAG service account on the gateway host.","analyst_note":"Confirm the vendor advisory and whether a workaround exists before upgrade; the sources give only the fixed version.","how_to_check":"Check the installed OAG version in the Admin Console and confirm it is below 2026.10.2.","needs_analyst":true,"not_affected_if":["managed-hosting","already-on-2026.10.2"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2943,"output_tokens":371,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give no affected versions or patch; check the NVD entry and Okta's security advisory for fixed OAG versions and mitigation steps.","search":"'-115547':13A,16A '-2026':12A,15A 'access':2A,18A,26B,39B,71C 'account':63B,101C 'admin':4A,41B,74C 'administr':54B,86C 'allow':76C 'authent':53B,85C 'command':10A,21B,51B,58B,93C 'command-inject':20B 'configur':46B,82C 'consol':5A,42B,75C 'context':96C 'cve':11A,14A 'execut':91C 'flaw':7A,35B 'format':45B,81C 'gateway':3A,19A,27B,40B,72C 'host':30B 'infrastructur':23B 'inject':22B 'input':6A,33B,65C 'issu':67C 'let':43B 'leverag':88C 'oag':61B,73C,99C 'okta':1A,17A,25B,38B,70C 'okta-access-gateway':24B 'process':49B,78C 'run':8A,56B 'self':29B 'self-host':28B 'servic':62B,100C 'special':44B,80C 'system':9A,57B,92C 'valid':34B,66C 'valu':47B,83C 'vendor':31B 'within':94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T04:18:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@okta.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115547","severity":null,"published_at":"2026-10-23T04:18:16+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115547:181","url":null,"severity":null,"published_at":"2026-10-23T22:13:39+00:00","modified_at":"2026-10-23T22:13:39+00:00","first_seen_at":"2026-10-23T22:13:39+00:00","fetched_at":"2026-10-23T22:13:39+00:00","note":"Read Okta advisory (Oct 22 2026): CVSS 9.1 (PR:H, S:C), fixed in OAG 2026.10.2. Exploitation status not stated; no PoC or discussion found (social not searched in depth). Admin Console version check not described by Okta."},{"source":"epss","external_id":"CVE-2026-115547","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115547","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1336,"url":"https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547","title":"Okta: Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}