the 9.1 in okta access gateway needs admin to use. the 8.1 shipped alongside it may be how a normal user gets admin CVE-2026-115547 (9.1): admin console config values get processed as code, so an OAG admin can run system commands as the OAG service account. its PR:H, so on its own it needs admin already CVE-2026-115546 (8.1): OAG doesnt validate the authentication source chosen at sign-on. a user with a valid session for any configured source can tamper with it and may get a SAML assertion that grants admin console access my reading of the two advisories, not a chain okta describes: the 8.1 hands an ordinary session the admin the 9.1 needs, which ends in command execution on the box sitting in front of ur legacy apps fix is OAG 2026.10.2, out since oct 15. advisories landed oct 22, normal lag. no known exploitation, no public PoC, not in KEV worth doing: get every node on 2026.10.2 (workers first, admin node last per oktas upgrade notes), check admin console access is limited to ur internal admin ranges, and review who has admin console access plus any admin sessions or config changes u cant account for from before u patched https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547