What is CVE-2026-78625?

CVE-2026-78625 is a medium-severity vulnerability in Okta Access Gateway, classified under Code Injection. CVSS score: 6.7/10. Published 2026-09-08.

How severe is CVE-2026-78625?

Medium severity. CVSS v3 base score is 6.7 out of 10.

RCE in Okta Access Gateway

CVE-2026-78625

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Okta Access Gateway

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@okta.com

Frequently asked questions

What is CVE-2026-78625?: CVE-2026-78625 is a medium-severity vulnerability in Okta Access Gateway, classified under Code Injection. CVSS score: 6.7/10. Published 2026-09-08.
How severe is CVE-2026-78625?: Medium severity. CVSS v3 base score is 6.7 out of 10.