Okta Okta Access Gateway
10 CVEs affecting Okta Okta Access Gateway. Latest disclosed: 2026-10-23. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-115547 | Critical | 9.1 | 2026-10-23 | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated ad… |
CVE-2026-115546 | High | 8.1 | 2026-10-23 | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the auth… |
CVE-2026-78626 | High | 8.1 | 2026-09-08 | The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an… |
CVE-2026-78623 | High | 7.7 | 2026-09-08 | The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. T… |
CVE-2026-78579 | Medium | 6.8 | 2026-09-08 | The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuratio… |
CVE-2026-78630 | Medium | 6.7 | 2026-09-08 | The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An… |
CVE-2026-78625 | Medium | 6.7 | 2026-09-08 | The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automaticall… |
CVE-2026-78550 | Medium | 6.6 | 2026-09-08 | The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a re… |
CVE-2026-78552 | Medium | 6.0 | 2026-09-08 | The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly in… |
CVE-2026-78624 | Medium | 4.9 | 2026-09-08 | The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents t… |