Executive Summary
CVE-2026-115547 is an input validation issue in the Okta Access Gateway (OAG) Admin Console. The console accepts specially formatted configuration values, and an authenticated administrator can use them to execute system commands in the context of the OAG service account.
CVSS Score: 9.1 (Critical)
The NVD entry was published on October 23, 2026. We could not retrieve the full NVD record, so affected and fixed versions are not confirmed here. Check Okta's advisory for the exact builds.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-115547 |
| CVSS Score | 9.1 (Critical) |
| Type | Input validation flaw leading to command execution |
| Component | OAG Admin Console configuration handling |
| Privileges Required | Authenticated administrator |
The administrator requirement lowers the odds of drive-by exploitation, but OAG sits in front of internal applications, so a compromised or malicious admin account, or stolen admin session, could become command execution on the gateway host.
Remediation
- Apply the fixed OAG release listed in Okta's security advisory as soon as it is confirmed for your version.
- Restrict Admin Console access to a management network and a small set of named administrators.
- Enforce MFA on OAG administrator accounts and review the current admin list.
- Audit recent configuration changes for unusual or malformed values.
- Monitor the OAG host for unexpected child processes from the service account.