Improper Input Handling in Okta Access Gateway Management Console Exception Handler CVE-2026-78550 - Sep 8, 2026
Description
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.
Affected product and versions
Customers using Okta Access Gateway appliance versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following preconditions are present:
The appliance’s SSH management interface is reachable from the local network,
The user has valid credentials for the appliance management account and can establish an SSH session to the management console.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.
Resolution
The vulnerability is present in the Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | Code Injection (Unsafe Eval) |
CWE | CWE-95 – Improper Neutralization of Directives in Dynamically Evaluated Code |
CVSS v3 | Score: 6.6 Vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |