Okta Patches Critical Access Gateway Flaw CVE-2026-115547

A critical input validation flaw (CVE-2026-115547, CVSS 9.1) in Okta's Access Gateway allowed authenticated administrators to execute arbitrary system commands directly on the appliance, representing a serious privilege escalation and remote code execution risk. The vulnerability resided in the Admin Console, meaning any compromised or malicious admin account could weaponize it to fully compromise the underlying system. Compounding the risk, a separate authentication bypass (CVE-2026-115546) and PHP2Shell-related flaws were disclosed simultaneously, creating a potential chained attack path. This matters because Access Gateway sits at the heart of enterprise identity infrastructure — its compromise could cascade into broader network access for attackers. Organizations running unpatched versions prior to 2026.10.2 remained exposed to complete appliance takeover.