Organisations using Okta Access Gateway should check their version and upgrade promptly. A critical command-execution vulnerability, documented in an advisory dated 22 October 2026 and tracked as CVE-2026-115547, affects versions of the appliance released before 2026.10.2, which contains the fix. The advisory assigns the flaw a CVSS score of 9.1, placing it firmly in the critical range.

Who can exploit it

Exploiting the flaw requires administrative access to the gateway's Admin Console, where specially formatted configuration values can be submitted to trigger system commands. That requirement matters: this is not an unauthenticated attack that anyone on the internet can fire at random. It is still serious, because an administrator account that is compromised, misused, or held by a malicious insider could turn a trusted management interface into a route to full control of the appliance.

Why gateways deserve priority

Access gateways sit in front of protected applications and decide who gets in. A compromise there can undermine the very controls an organisation relies on to protect internal systems. That is why even flaws that need administrator access should not be left unpatched on internet-facing infrastructure, where stolen credentials and phishing remain common routes to privileged accounts.

What defenders should do

Upgrade to version 2026.10.2 or later, review who holds administrator access to the Admin Console, enforce strong multi-factor authentication for those accounts, and monitor admin activity for unusual configuration changes. Organisations that cannot upgrade immediately should restrict Admin Console access to trusted networks and administrators only, and treat any unexpected admin changes as a reason to investigate.