Threat reportVulnerabilityTL-2026-4279
Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets Admin-Level Attackers Execute System Commands
Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets (TL-2026-4279) is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-10-23. It has no confirmed attribution, affects Okta Okta Access Gateway (OAG) appliance, references 5 CVEs (CVE-2026-115547, CVE-2026-115546, CVE-2026-109618), maps to 2 MITRE ATT&CK techniques (T1059, T1078), and is covered by 9 detection rules and 3 indicators of compromise.
- CVSS
- 9.1/10Critical
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 2MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 3Indicators of compromise
Key facts for TL-2026-4279
- Threat ID
- TL-2026-4279
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise identity and access management
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 3
How Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets works
Okta Access Gateway (OAG) appliance versions prior to 2026.10.2 contain an input-validation / code-injection flaw (CWE-94, CWE-20) in the Admin Console that lets an authenticated administrator execute system commands as the OAG service account via specially formatted configuration values. Rated CVSS 9.1; fixed in 2026.10.2 with no vendor workaround, and no active exploitation or public payload reported.
CVE-2026-115547 is an input-validation weakness in the Okta Access Gateway Admin Console. When the console processes specially formatted configuration values, an attacker who already holds an authenticated administrator session can cause system commands to run in the context of the OAG service account. Okta published the advisory on 2026-10-22 and the NVD record followed on 2026-10-23. The affected product is the OAG appliance, all versions prior to 2026.10.2; the fix is 2026.10.2 or later.
The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (base 9.1). The high score comes from the changed scope and full CIA impact, while the High privileges-required metric reflects that no authentication bypass is part of this issue. The weakness is classified CWE-94 (improper control of generation of code) and CWE-20 (improper input validation). Neither the Okta advisory nor the press coverage names the specific configuration field or publishes an attack payload, and the advisory credits no reporter.
Okta published two other OAG advisories on the same day, both fixed in 2026.10.2 or the same release train: CVE-2026-115546 (Authentication Source Verification, CVSS 8.1), where an authenticated user can alter the authentication source parameter and obtain a SAML assertion granting Admin Console access, and the PHP runtime issues CVE-2026-109618 / CVE-2026-109619. The advisories do not state that these are chained with CVE-2026-115547, but defenders should treat the combination as a plausible path from a low-privileged session to admin and then to command execution, and prioritize patching all of them together. Earlier OAG issues fixed in 2026.9.1 (for example CVE-2026-78550, eval() injection in the management console, and CVE-2026-78630, OS command injection via SNMP configuration) show a recurring pattern of input-handling flaws in OAG administrative interfaces.
No exploitation in the wild, proof-of-concept, IOCs or threat-actor attribution has been reported. Okta documents no workaround; remediation is to upgrade the appliance. Defenders should additionally review who holds Admin Console administrator access and investigate unexpected configuration changes and unexpected child processes of the OAG service account.
MITRE ATT&CK techniques used in TL-2026-4279
Execution
T1059 Command and Scripting Interpreter
Initial Access
Persistence
Privilege Escalation
Defense Evasion
Affected products and versions in Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets
- Okta — Okta Access Gateway (OAG) appliance
Vulnerable versions: All versions prior to 2026.10.2
Fixed in: 2026.10.2 or later
Remediation for Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets
Patches
- Okta Access Gateway 2026.10.2 or later (advisory CVE-2026-115547, 2026-10-22)
- Apply the same release for CVE-2026-115546 (Authentication Source Verification) and the PHP runtime advisories CVE-2026-109618 / CVE-2026-109619
Immediate actions
- Upgrade Okta Access Gateway appliances to version 2026.10.2 or later
- Review and minimize the set of accounts with Okta Access Gateway Admin Console administrator access
- Investigate unexpected Admin Console configuration changes
Workarounds
- None documented by Okta; upgrade is the only stated remediation
Longer-term hardening
- Restrict network reachability of the OAG Admin Console to management networks
- Forward OAG Admin Console audit logs and appliance process telemetry to the SIEM and alert on anomalous administrative changes
- Monitor for unexpected child processes spawned by the OAG service account
CVEs associated with Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets
CVE-2026-115547, CVE-2026-115546, CVE-2026-109618, CVE-2026-109619, CVE-2026-78550
Weaknesses (CWE) in Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets
Timeline of Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets
- Earlier OAG administrative-interface input-handling flaws (e.g. CVE-2026-78550, CVE-2026-78630) were fixed in Okta Access Gateway 2026.9.1 (September 2026 release train; exact publication date approximate).
- Okta published sibling OAG advisories the same day: CVE-2026-115546 (Authentication Source Verification, CVSS 8.1) and PHP runtime CVE-2026-109618 / CVE-2026-109619.
- Okta Access Gateway 2026.10.2 released as the fixed version; no workaround documented.
- Okta published the security advisory 'Command Execution via Admin Console Input in Okta Access Gateway' for CVE-2026-115547 (CVSS 9.1).
- Cyber Security News reported the flaw publicly, noting no active exploitation, attack payloads or affected configuration field were disclosed.
- NVD published the CVE-2026-115547 record with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H and CWE-20 / CWE-94.
Sources cited for Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets
- Okta Security Advisory: Command Execution via Admin Console Input in Okta Access Gateway (CVE-2026-115547)
- NVD: CVE-2026-115547
- Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands
- Okta Security Advisory: Authentication Source Verification Issue in Okta Access Gateway (CVE-2026-115546)
- Okta Security Advisory: PHP Runtime Vulnerabilities Affecting Okta Access Gateway (CVE-2026-109618 / CVE-2026-109619)
- Okta Security Advisories index
- Okta Security Advisory: Improper Input Handling in Okta Access Gateway Management Console Exception Handler (CVE-2026-78550)
Detection coverage for TL-2026-4279
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4279 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.