Recommended action window: Monitor and triage in normal cycle
NVD description
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Okta fixes four Okta Access Gateway vulnerabilities, including PHP2Shell and CVE-2026-115547 command execution. Upgrade OAG to 2026.44.0. #Okta #OktaAccessGateway #PHP2Shell #CVE2026115547 #CVE2026115546 #IAM #SAML #CyberSecurity https://securityonline.info/okta-access-gateway-vulnerabilities-php2shell/
the 9.1 in okta access gateway needs admin to use. the 8.1 shipped alongside it may be how a normal user gets admin CVE-2026-115547 (9.1): admin console config values get processed as code, so an OAG admin can run system commands as the OAG service account. its PR:H, so on its own it needs admin already CVE-2026-115546 (8.1): OAG doesnt validate the authentication source chosen at sign-on. a user with a valid session for any configured source can tamper with it and may get a SAML assertion that grants admin console access my reading of the two advisories, not a chain okta describes: the 8.1 hands an ordinary session the admin the 9.1 needs, which ends in command execution on the box sitting in front of ur legacy apps fix is OAG 2026.10.2, out since oct 15. advisories landed oct 22, normal lag. no known exploitation, no public PoC, not in KEV worth doing: get every node on 2026.10.2 (workers first, admin node last per oktas upgrade notes), check admin console access is limited to ur internal admin ranges, and review who has admin console access plus any admin sessions or config changes u cant account for from before u patched https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547