External risk intelligence

Okta Access Gateway Admin Console Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-115547

The vulnerability exists in the Okta Access Gateway (OAG) Admin Console. While the console is an administrative interface, it is part of an edge gateway product designed to manage external access and traffic, often making such management surfaces reachable or targeted within network-exposed deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An input validation flaw in the Okta Access Gateway Admin Console could allow an authenticated administrator to execute system commands. This vulnerability affects how configuration values are processed, potentially enabling unauthorized actions within the service account context of the gateway. The main concern is confirming relevance and exposure for your Okta Access Gateway deployments.

Issue: Command execution in Okta Access Gateway admin tool.
Why remember: Affects gateway for external access management.
Takeaway: Confirm relevance and exposure of Okta Access Gateway.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to the Okta Access Gateway Admin Console could provide specially crafted configuration settings. The console's failure to properly validate these inputs could then allow the attacker to run system commands, giving them control over the gateway's service account.

Authenticated administrator access required.
Specially formatted configuration values trigger vulnerability.
Arbitrary system command execution possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Okta Access Gateway Admin Console could allow an authenticated administrator to execute system commands as the OAG service account. This could happen when specially formatted configuration values are processed, potentially impacting the gateway's operational integrity or allowing unauthorized actions within the system.

System commands on the OAG service account.
Processing specially formatted configuration values.
Unauthorized command execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Okta Access Gateway (OAG) product, specifically its Admin Console, is likely managed by infrastructure or platform teams responsible for identity and access management solutions. The first practical step is to confirm the presence of OAG, assess its network exposure and business criticality, and then identify the accountable owner to plan remediation.

Ownership: Infrastructure or Identity and Access Management teams.
Verify first: OAG deployment and network exposure.
Action: Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Okta Access Gateway?

Okta Access Gateway (OAG) is a software solution that enables organizations to extend Okta's identity and access management capabilities to on-premises applications. It acts as a bridge, securing external user access to legacy systems that do not natively support modern authentication protocols. Organizations deploy it as an edge gateway to manage traffic flow and enforce security policies before requests reach their internal applications.

How does CVE-2026-115547 work?

This vulnerability is classified as an input validation issue (CWE-20) that can lead to code injection (CWE-94). It occurs when the OAG Admin Console fails to properly sanitize configuration values. Because the system trusts this input during processing, a user with administrative privileges can inject and execute arbitrary system commands, running them with the same permissions as the underlying OAG service account.

Do I need to be an administrator to trigger this bug?

Yes, successful exploitation requires authenticated access to the OAG Admin Console. It cannot be triggered by unauthenticated users or through standard application traffic passing through the gateway. Only input provided by a logged-in administrator during configuration tasks can cause the system to process the malicious commands.

Why does Halo Surface Signal categorize this as likely to be relevant?

Halo Surface Signal flags this as likely relevant because the vulnerability resides in an edge gateway product. Even though it is an administrative interface, OAG is designed to sit at the network edge to manage external traffic. This position often results in management surfaces being reachable within network-exposed environments, increasing the potential for unauthorized access.

How should I respond to this vulnerability?

Start by identifying all deployed instances of Okta Access Gateway within your environment and confirming which teams are responsible for their maintenance. Assess the network accessibility of these Admin Consoles to determine their exposure level. Once you have an inventory and have evaluated the risk to your infrastructure, work with your Identity and Access Management team to plan and implement the necessary patches or security updates.

References

trust.okta.com/security-advisories/command-execution-via-admin-conso…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.