Okta Access Gateway: admin-console command execution and an auth-source bypass to the Admin Console (CVE-2026-115547, CVE-2026-115546)
Okta Access Gateway (on-prem appliance)
Okta fixed two Okta Access Gateway (OAG) bugs on Oct 22. CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the OAG service account through specially formatted configuration values. CVE-2026-115546 (CVSS 8.1) lets any user with a valid session change the authentication-source parameter during sign-on and get a SAML assertion for the Admin Console. Combined, a regular gateway user could potentially reach command execution. Both are fixed in 2026.10.2. OAG also bundles a PHP runtime hit by PHP2Shell, fixed in 2026.44.0 (released Oct 23). Okta's cloud services are not affected.
Why this severity: CVE-2026-115547 CVSS 3.1 9.1 (admin required); CVE-2026-115546 CVSS 8.1; no known exploitation
- Started
- Oct 22, 2026
Affected
- Okta Access Gateway before 2026.10.2
- PHP2Shell: OAG before 2026.44.0 (PHP 8.3.x before 8.3.36)
Fixed in
- 2026.10.2 (CVE-2026-115547, CVE-2026-115546)
- 2026.44.0 (also includes PHP 8.3.36 for PHP2Shell)
Timeline2
Advisories4
- Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547Okta · Oct 22, 2026
- Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546Okta · Oct 22, 2026
- PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619Okta · Oct 22, 2026
- Okta Access Gateway release notesOkta
News & write-ups1
Notes & caveats
The chaining of CVE-2026-115546 into CVE-2026-115547 is our reading of the two advisories, not an Okta statement. PHP2Shell itself is tracked on php2shell-cve-2026-109618-109619.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
