# Okta Access Gateway: admin-console command execution and an auth-source bypass to the Admin Console (CVE-2026-115547, CVE-2026-115546) · pwn.watch

> Okta fixed two Okta Access Gateway (OAG) bugs on Oct 22. CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the OAG service account through specially formatted configuration values. CVE-2026-115546 (CVSS 8.1) lets any user with a valid session change the authentication-source parameter during sign-on and get a SAML assertion for the Admin Console. Combined, a regular gateway user could potentially reach command execution. Both are fixed in 2026.10.2. OAG also bundles a PHP runtime hit by PHP2Shell, fixed in 2026.44.0 (released Oct 23). Okta's cloud services are not affected.

Page: https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Okta Access Gateway (on-prem appliance)
- Started: 2026-10-22
- CVEs: CVE-2026-115547, CVE-2026-115546
- Affected: Okta Access Gateway before 2026.10.2; PHP2Shell: OAG before 2026.44.0 (PHP 8.3.x before 8.3.36)
- Fixed in: 2026.10.2 (CVE-2026-115547, CVE-2026-115546); 2026.44.0 (also includes PHP 8.3.36 for PHP2Shell)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546/feed.xml
- JSON Feed: https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546.json
- This file: https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546/llms.txt

## Updates (newest first)
- 2026-10-23: Okta releases Access Gateway 2026.44.0 with PHP 8.3.36; Okta says public PHP2Shell PoCs did not get code execution on a default OAG. (https://help.okta.com/oag/en-us/Content/Topics/releasenotes/oag/oag-release-notes.htm)
- 2026-10-22: Okta publishes advisories for CVE-2026-115547 and CVE-2026-115546 (fixed in 2026.10.2) and for PHP2Shell in OAG's PHP runtime. (https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547)

## Fix brief
# Security brief: Okta Access Gateway: admin-console command execution and an auth-source bypass to the Admin Console (CVE-2026-115547, CVE-2026-115546)

Source: https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546 · status: live · severity: critical · updated Oct 24, 2026, 06:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Okta fixed two Okta Access Gateway (OAG) bugs on Oct 22. CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the OAG service account through specially formatted configuration values. CVE-2026-115546 (CVSS 8.1) lets any user with a valid session change the authentication-source parameter during sign-on and get a SAML assertion for the Admin Console. Combined, a regular gateway user could potentially reach command execution. Both are fixed in 2026.10.2. OAG also bundles a PHP runtime hit by PHP2Shell, fixed in 2026.44.0 (released Oct 23). Okta's cloud services are not affected.

Severity detail: CVE-2026-115547 CVSS 3.1 9.1 (admin required); CVE-2026-115546 CVSS 8.1; no known exploitation

- Product: Okta Access Gateway (on-prem appliance)
- CVE / advisory ids: CVE-2026-115547, CVE-2026-115546

## Affected versions
- Okta Access Gateway before 2026.10.2
- PHP2Shell: OAG before 2026.44.0 (PHP 8.3.x before 8.3.36)

## Check whether you're affected
Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:

```sh
php -v
php -r 'echo PHP_VERSION, PHP_EOL;'
```

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 2026.10.2 (CVE-2026-115547, CVE-2026-115546)
- 2026.44.0 (also includes PHP 8.3.36 for PHP2Shell)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Upgrade Okta Access Gateway appliances to 2026.44.0 (covers both CVEs and PHP2Shell). Okta and Auth0 cloud tenants need no action.

## Latest updates
- Oct 23, 2026: Okta releases Access Gateway 2026.44.0 with PHP 8.3.36; Okta says public PHP2Shell PoCs did not get code execution on a default OAG.
- Oct 22, 2026: Okta publishes advisories for CVE-2026-115547 and CVE-2026-115546 (fixed in 2026.10.2) and for PHP2Shell in OAG's PHP runtime.

## Advisories
- [Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547](https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547) (Okta)
- [Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546](https://trust.okta.com/security-advisories/authentication-source-verification-issue-in-okta-access-gateway-cve-2026-115546/) (Okta)
- [PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 / CVE-2026-109619](https://trust.okta.com/security-advisories/php-runtime-vulnerabilities-affecting-okta-access-gateway-cve-2026-109618-cve-2026-109619) (Okta)
- [Okta Access Gateway release notes](https://help.okta.com/oag/en-us/Content/Topics/releasenotes/oag/oag-release-notes.htm) (Okta)

## Write-ups & news
- [Okta's Response to PHP2Shell](https://sec.okta.com/articles/2026/10/okta-response-to-php2shell/)

## Caveats
The chaining of CVE-2026-115546 into CVE-2026-115547 is our reading of the two advisories, not an Okta statement. PHP2Shell itself is tracked on php2shell-cve-2026-109618-109619.

---
Machine-readable: https://pwn.watch/i/okta-access-gateway-cve-2026-115547-115546.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.