Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing CVE-2026-78630 - Sep 8, 2026
Description
The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.
Affected product and versions
Customers using the Okta Access Gateway versions prior to 2026.9.1 are affected.
Preconditions
This applies if the following precondition is present:
The appliance’s SSH management interface is reachable from the local network,
A user has valid credentials for the appliance management account and can establish an SSH session to the management console,
The user navigates to the SNMP configuration menu within the management console.
Customer Recommendations
To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.
Resolution
The vulnerability is present in the Okta Access Gateway appliance versions prior to 2026.9.1 and is resolved in version 2026.9.1.
CVE details
CVE ID | |
Published Date | 2026-09-08 |
Vulnerability Type | OS Command Injection |
CWE | CWE-78 – Improper Neutralization of Special Elements used in an OS Command |
CVSS v3 | Score: 6.7 Vector string: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |