Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
Okta Access Gateway critical flaw allows admin command execution.
Okta has disclosed a critical vulnerability (CVE-2026-115547) in Okta Access Gateway versions prior to 2026.10.2. The flaw allows an authenticated administrator to execute system commands through the Admin Console due to weak input validation. Successful exploitation grants the attacker the permissions of the OAG service account, with potential impacts on confidentiality, integrity, and availability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Okta?
Get an email when a new story names Okta, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability in Okta Access Gateway (CVE-2026-115547) allowed authenticated administrators to execute arbitrary system commands through the Admin Console due to insufficient input validation. While requiring administrative credentials reduces the attack surface, compromised or malicious admin accounts could leverage this flaw to fully escalate privileges to the OAG service account level, threatening confidentiality, integrity, and availability. This highlights the danger of assuming that authenticated users — even administrators — can be fully trusted when input handling is weak. Organizations relying on Okta Access Gateway as a critical identity perimeter component face significant risk until patched, as this component sits at the heart of access control decisions.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-115547