Okta recently announced a critical security vulnerability affecting its Access Gateway, specifically allowing authenticated administrators to execute system commands through the Admin Console. This flaw, identified as CVE-2026-115547, impacts versions prior to 2026.10.2 and has been assigned a CVSS v3.1 score of 9.1, highlighting its severity. The root of the issue lies in inadequate input validation within the Admin Console, which can process specially crafted configuration values in a way that permits system command execution.

The vulnerability, classified under CWE-94 for improper control of code generation and CWE-20 for improper input validation, requires attackers to have administrative access to exploit it. This requirement limits the potential attack surface, as an attacker must first gain such access to the OAG Admin Console. The flaw does not provide an unauthenticated attack vector, which means that regular application accounts are not sufficient for exploitation.

When exploited, the vulnerability allows commands to be executed with the permissions of the OAG service account. While this does not equate to root access, the impact depends heavily on the permissions granted to the service account. The CVSS v3.1 vector indicates a network attack with low complexity but high privilege requirements, significantly impacting confidentiality, integrity, and availability.

Organizations utilizing Okta Access Gateway versions before 2026.10.2 are strongly advised to upgrade to the latest version to mitigate this risk. This update is critical as it addresses the vulnerability, with no alternative workarounds provided. Administrators should also assess who has access to the management console and monitor for unexpected configuration changes. Although there is no evidence of active exploitation, vigilance is necessary. Teams should regularly check Okta’s security advisory portal for updates and further instructions.