Executive Summary
CVE-2026-115547 is a critical command execution vulnerability affecting the Okta Access Gateway (OAG) Admin Console. This flaw enables authenticated administrators to execute arbitrary system commands on the underlying appliance by submitting specially crafted configuration values. The vulnerability is rated CVSS 9.1 (Critical) and impacts all Okta Access Gateway versions prior to 2026.10.2. While exploitation requires administrative access, the vulnerability is network-exploitable, low complexity, and does not require user interaction. There is currently no evidence of exploitation in the wild, no public proof-of-concept code, and no attribution to advanced persistent threat (APT) groups. The risk profile is high due to the privileged nature of the affected interface and the potential for lateral movement within enterprise environments.
Technical Information
CVE-2026-115547 is a code injection vulnerability in the Okta Access Gateway Admin Console. The flaw arises from improper input validation in configuration fields, allowing an authenticated administrator to inject specially crafted values that are subsequently executed as system commands under the context of the OAG service account. This vulnerability is classified under CWE-94 (Improper Control of Code Generation) and CWE-20 (Improper Input Validation).
The attack vector is network-based, requiring only access to the OAG Admin Console. The attack complexity is low, as no user interaction is required beyond administrative authentication. The vulnerability impacts confidentiality, integrity, and availability, as successful exploitation allows attackers to access sensitive files, logs, tokens, and integration secrets, and potentially pivot to other systems integrated with the gateway.
The vulnerability is present in all Okta Access Gateway versions prior to 2026.10.2. The issue is resolved in version 2026.10.2 and later. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of June 2024, and there is no CISA-confirmed evidence of active exploitation.
The vulnerability maps to the following MITRE ATT&CK techniques: Execution (TA0002), Command and Scripting Interpreter (T1059), and OS Command Injection (T1059.003). Privilege escalation and persistence depend on the permissions of the OAG service account and the configuration of the appliance.
Exploitation in the Wild
As of the time of writing, there is no public evidence of exploitation in the wild for CVE-2026-115547. No public proof-of-concept code has been released, and no threat intelligence sources or vendors have reported observed exploitation attempts. The vulnerability is not included in the CISA KEV catalog, and there are no confirmed ransomware or APT campaigns leveraging this flaw. However, due to the critical nature of the vulnerability and the privileged access required, organizations should remain vigilant and monitor for any signs of suspicious activity related to the OAG Admin Console.
APT Groups using this vulnerability
There are currently no known APT groups or threat actors publicly linked to the exploitation of CVE-2026-115547. No sector-specific or country-specific targeting has been reported in connection with this vulnerability. The absence of public exploitation does not preclude the possibility of targeted attacks in the future, especially given the high-value access provided by the OAG Admin Console.
Affected Product Versions
All versions of Okta Access Gateway prior to 2026.10.2 are affected by CVE-2026-115547. This includes every OAG release before 2026.10.2. The vulnerability is resolved in version 2026.10.2 and later. Organizations running any earlier version are at risk and should prioritize upgrading to the latest release.
Workaround and Mitigation
The primary remediation for CVE-2026-115547 is to upgrade all Okta Access Gateway appliances to version 2026.10.2 or later. Okta has released this version specifically to address the vulnerability. In addition to upgrading, organizations should review and restrict administrative access to the OAG Admin Console, enforce multi-factor authentication (MFA), and apply the principle of least privilege to all administrative accounts.
It is recommended to regularly audit configuration changes and system command execution logs for anomalies, and to ensure that the OAG service account has only the minimum permissions required for operation. Treating OAG appliances as Tier-0 assets and applying heightened security controls is strongly advised.
Indicators of Compromise
The following caveat applies: Indicators of compromise are point-in-time and should be validated before enforcement. At the time of writing, no public indicators of compromise (IOCs) have been published for CVE-2026-115547. Organizations are advised to monitor for unusual configuration changes in OAG Admin Console logs, unexpected system command execution or process creation under the OAG service account, and unauthorized access or privilege escalation events in OAG logs.
No public indicators of compromise were available at the time of writing.
References
Okta Security Advisory, Cyber Kendra Article, Dark Web Informer on X, a cybersecurity professional on LinkedIn, NVD Entry
Rescana is here for you
Rescana provides a comprehensive third-party risk management (TPRM) platform that empowers organizations to continuously monitor, assess, and mitigate cyber risks across their vendor ecosystem. Our platform leverages advanced threat intelligence, automation, and analytics to help you stay ahead of emerging threats and regulatory requirements. We are happy to answer any questions at info@rescana.com.
