Okta Access Gateway
Approved changes feed: RSS · Atom
cpe:2.3:a:okta:okta_access_gateway:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Okta (23e081ab-902b-5fcb-b218-10b72ec8f1f4) |
|---|---|
| Product | Okta Access Gateway (4943758a-5bb5-5862-878f-ebfda097b6b9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-115547 |
vulnerable | 2026-11-03 10:15:37.403707 |
Command Execution via Admin Console Input in Okta Access Gateway
CRITICAL (9.1)
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
Published: 2026-10-23T03:06:45.274Z
Updated: 2026-10-23T10:56:08.187Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-115546 |
vulnerable | 2026-11-03 10:15:37.337022 |
Authentication Source Verification Issue in Okta Access Gateway
HIGH (8.1)
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.
Published: 2026-10-23T03:06:37.230Z
Updated: 2026-10-23T10:56:08.332Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78630 |
vulnerable | 2026-09-16 04:33:44.691195 |
Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing
MEDIUM (6.7)
The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.
Published: 2026-09-08T20:14:52.442Z
Updated: 2026-09-10T14:40:54.476Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78579 |
vulnerable | 2026-09-16 04:33:44.687562 |
Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
MEDIUM (6.8)
The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of the intended query logic.
Published: 2026-09-08T20:12:53.558Z
Updated: 2026-09-10T14:37:56.057Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78624 |
vulnerable | 2026-09-16 04:33:44.686673 |
Improper Path Validation in Okta Access Gateway Backup and Restore Functionality
MEDIUM (4.9)
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.
Published: 2026-09-08T20:10:15.711Z
Updated: 2026-09-10T14:31:46.246Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78550 |
vulnerable | 2026-09-16 04:33:44.684405 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78620 |
vulnerable | 2026-09-16 04:33:44.678391 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78625 |
vulnerable | 2026-09-16 04:33:44.674430 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78560 |
vulnerable | 2026-09-16 04:33:44.673694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78545 |
vulnerable | 2026-09-16 04:33:44.617066 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78623 |
vulnerable | 2026-09-16 04:33:44.563731 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78626 |
vulnerable | 2026-09-16 04:33:44.391186 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-78552 |
vulnerable | 2026-09-16 04:33:44.387846 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.