# Critical Okta Access Gateway Flaw (CVE-2026-115547) Lets Admin-Level Attackers Execute System Commands

> Okta Access Gateway (OAG) appliance versions prior to 2026.10.2 contain an input-validation / code-injection flaw (CWE-94, CWE-20) in the Admin Console that lets an authenticated administrator execute system commands as the OAG service account via specially formatted configuration values. Rated CVSS 9.1; fixed in 2026.10.2 with no vendor workaround, and no active exploitation or public payload reported.

- **Published:** 2026-10-23T15:57:32Z
- **Last reviewed:** 2026-10-23T15:57:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4279
- **ID:** TL-2026-4279
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-115547, CVE-2026-115546, CVE-2026-109618, CVE-2026-109619, CVE-2026-78550

## Description

CVE-2026-115547 is an input-validation weakness in the Okta Access Gateway Admin Console. When the console processes specially formatted configuration values, an attacker who already holds an authenticated administrator session can cause system commands to run in the context of the OAG service account. Okta published the advisory on 2026-10-22 and the NVD record followed on 2026-10-23. The affected product is the OAG appliance, all versions prior to 2026.10.2; the fix is 2026.10.2 or later.

The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (base 9.1). The high score comes from the changed scope and full CIA impact, while the High privileges-required metric reflects that no authentication bypass is part of this issue. The weakness is classified CWE-94 (improper control of generation of code) and CWE-20 (improper input validation). Neither the Okta advisory nor the press coverage names the specific configuration field or publishes an attack payload, and the advisory credits no reporter.

Okta published two other OAG advisories on the same day, both fixed in 2026.10.2 or the same release train: CVE-2026-115546 (Authentication Source Verification, CVSS 8.1), where an authenticated user can alter the authentication source parameter and obtain a SAML assertion granting Admin Console access, and the PHP runtime issues CVE-2026-109618 / CVE-2026-109619. The advisories do not state that these are chained with CVE-2026-115547, but defenders should treat the combination as a plausible path from a low-privileged session to admin and then to command execution, and prioritize patching all of them together. Earlier OAG issues fixed in 2026.9.1 (for example CVE-2026-78550, eval() injection in the management console, and CVE-2026-78630, OS command injection via SNMP configuration) show a recurring pattern of input-handling flaws in OAG administrative interfaces.

No exploitation in the wild, proof-of-concept, IOCs or threat-actor attribution has been reported. Okta documents no workaround; remediation is to upgrade the appliance. Defenders should additionally review who holds Admin Console administrator access and investigate unexpected configuration changes and unexpected child processes of the OAG service account.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts

## Sources

- [Okta Security Advisory: Command Execution via Admin Console Input in Okta Access Gateway (CVE-2026-115547)](https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547)
- [NVD: CVE-2026-115547](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-115547)
- [Critical Okta Access Gateway Flaw Lets Attackers With Admin Access Execute System Commands](https://cybersecuritynews.com/okta-access-gateway-flaw/)
- [Okta Security Advisory: Authentication Source Verification Issue in Okta Access Gateway (CVE-2026-115546)](https://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546)
- [Okta Security Advisory: PHP Runtime Vulnerabilities Affecting Okta Access Gateway (CVE-2026-109618 / CVE-2026-109619)](https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619)
- [Okta Security Advisories index](https://trust.okta.com/security-advisories/)
- [Okta Security Advisory: Improper Input Handling in Okta Access Gateway Management Console Exception Handler (CVE-2026-78550)](https://trust.okta.com/security-advisories/improper-input-handling-in-okta-access-gateway-management-console-exception-handler-cve-2026-78550)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4279