Okta Access Gateway
Security incidents tagged Okta Access Gateway. Newest first.
1 Okta Access Gateway incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 2
- Longest quiet run: 1 day (Oct 24–Oct 24)
- Patched
Okta Access Gateway: admin-console command execution and an auth-source bypass to the Admin Console (CVE-2026-115547, CVE-2026-115546)
Okta fixed two Okta Access Gateway (OAG) bugs on Oct 22. CVE-2026-115547 (CVSS 9.1) lets an authenticated administrator run system commands as the OAG service account through specially formatted configuration values. CVE-2026-115546 (CVSS 8.1) lets any user with a valid session change the authentication-source parameter during sign-on and get a SAML assertion for the Admin Console. Combined, a regular gateway user could potentially reach command execution. Both are fixed in 2026.10.2. OAG also bundles a PHP runtime hit by PHP2Shell, fixed in 2026.44.0 (released Oct 23). Okta's cloud services are not affected.
Okta Access Gateway (on-prem appliance)Since Oct 22, 2026
