Critical Okta Access Gateway flaw lets admins execute system commands CVE-2023-28758

Key Takeaways

• A critical security flaw (CVE-2026-115547) has been identified in Okta Access Gateway.
• The vulnerability allows authenticated administrators to execute arbitrary system commands through the Admin Console.
• It affects Okta Access Gateway versions prior to 2026.10.2 and carries a CVSS v3.1 score of 9.1.
• A patch is available in version 2026.10.2 and later; immediate upgrade is strongly recommended.

Critical Flaw Discovered in Okta Access Gateway

Okta has issued a warning regarding a significant security vulnerability within its Okta Access Gateway product. The flaw, designated CVE-2026-115547, enables an authenticated administrator to execute system commands directly via the appliance’s Admin Console, posing a substantial risk to affected deployments.

The vulnerability impacts all Okta Access Gateway versions preceding 2026.10.2. According to an advisory released on October 22, 2026, the issue is rated with a CVSS v3.1 score of 9.1, indicating its critical severity. At its core, the problem stems from insufficient input validation when the Admin Console processes specific configuration values.

Understanding the Exploitation Mechanism

Exploitation of CVE-2026-115547 requires an attacker to first gain administrative access to the Okta Access Gateway (OAG) Admin Console. Once authenticated, a malicious actor can craft specially formatted configuration inputs. These inputs bypass the intended validation checks, allowing the system to interpret them as executable commands rather than benign configuration data.

Okta classifies the issue under two common weakness enumerations: CWE-94 (Improper Control of Code Generation) and CWE-20 (Improper Input Validation). The critical requirement for administrative access means that the vulnerability is not exploitable by unauthenticated attackers or those with only regular application user accounts, and the advisory does not mention any authentication bypasses.

Successful command execution occurs under the permissions of the OAG service account. While this does not automatically equate to root access, the potential impact on confidentiality, integrity, and availability is considered high, with the scope of impact also rated high in the CVSS vector. Organizations must assess the specific privileges of their OAG service account to fully understand their exposure.

Patch and Mitigation Guidance

Okta has released version 2026.10.2 of the Access Gateway, which contains the necessary fix for this vulnerability. Organizations utilizing any version prior to 2026.10.2 are strongly advised to upgrade to this patched release or a later version immediately. No alternative workarounds have been provided by Okta.

This latest patch follows a series of previous security updates for Okta Access Gateway and Auth0, which addressed issues like authorization bypasses, SQL injection, and stored cross-site scripting. It is important to note that the earlier Access Gateway 2026.9.1 update does not resolve CVE-2026-115547, as the requirements and fixes differ.

While the advisory does not report active exploitation, disclose specific attack payloads, or identify the exact configuration field involved, these omissions should not deter immediate action. Cybersecurity teams should prioritize the appliance upgrade and consult Okta’s security advisory portal for any further updates or guidance.

What You Should Do

• Upgrade Immediately: Update your Okta Access Gateway instances to version 2026.10.2 or newer without delay.
• Review Access Controls: Scrutinize and restrict administrative access to the OAG Admin Console, ensuring only authorized personnel can reach it.
• Monitor for Anomalies: Actively monitor your Access Gateway for any unusual configuration changes or suspicious activity that could indicate compromise.
• Stay Informed: Regularly check Okta’s official security advisories for the latest information and any additional mitigation steps.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.