Okta has published an advisory detailing CVE-2026-115547, a critical code injection vulnerability affecting the administrative console of Okta Access Gateway. The flaw allows an authenticated administrator to execute arbitrary commands on the appliance with the permissions of the gateway service account.
The vulnerability carries a CVSS 3.1 base score of 9.1 and is classified under CWE-94 (Improper Control of Generation of Code) and CWE-20 (Improper Input Validation). It resides in the console’s handling of configuration values submitted in a specific format, bypassing expected input restrictions.
Versions of the Access Gateway appliance prior to 2026.10.2 are affected. Okta states that the issue is resolved in 2026.10.2 and later releases. No mitigation or workaround is available, making immediate patching the only recommended action.
Exploitation requires administrative access to the Access Gateway console. The advisory notes high privileges as a prerequisite and changed scope, indicating potential impact on components beyond the vulnerable appliance itself. No unauthenticated attack vector or authentication bypass is described.
On the same day, Okta released two additional advisories for the product. One addresses authentication source verification (CVE-2026-115546). The second covers PHP execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, the same issues previously confirmed by Palo Alto Networks in PAN-OS.
Okta has not reported any active exploitation, named threat actors, or provided proof-of-concept code. No external researcher is credited for the discovery. Operators are advised to verify installed versions and review administrative console access permissions.
