Okta has published three advisories covering four vulnerabilities in Okta Access Gateway, including a CVSS 9.1 flaw that lets an authenticated administrator run system commands. The company reported no attacks against the product and released fixed versions on October 22.
CVE-2026-115547 Allows System Commands as the Gateway Service Account
CVE-2026-115547, rated CVSS 9.1, is an input validation flaw in the Admin Console of Okta Access Gateway, often shortened to OAG. An authenticated administrator can exploit it to run system commands as the OAG service account. Because the attacker must already hold administrator access, the flaw is a route to a deeper level of control rather than an initial break-in path.
The Authentication Source Bypass in CVE-2026-115546
CVE-2026-115546 has a CVSS score of 8.1. OAG fails to validate the authentication source selected at sign-on. A user with any valid session can change that selection and potentially obtain a SAML assertion that grants access to the Admin Console. In effect, the flaw could let a user with ordinary access reach the administrative interface, which in turn is the position needed for the command execution bug above.
Okta’s advisories cover four vulnerabilities in total. The sources describe the two highest-rated flaws in detail; the company grouped all four across three advisories.
OAG Bundles a PHP Version Affected by PHP2Shell
The advisories also address the PHP2Shell remote code execution flaws, which affect PHP 8.3. OAG bundles that PHP version. Okta said OAG’s default configuration mitigates known exploitation of the PHP2Shell flaws, so the bundled component was not considered exposed to known attacks in a default deployment.
The fixed releases update the bundled PHP to version 8.3.36. Okta shipped the fix in OAG 2026.44.0, which includes PHP 8.3.36, and in 2026.10.2.
Okta’s Statement on No Observed Attacks Against OAG
Okta reported no attacks on Access Gateway, including attacks using the PHP2Shell flaws. The company’s position is that the default configuration of the product already blocks the known exploitation of those PHP flaws, and the update to PHP 8.3.36 closes the remaining exposure in the bundled component.
What Admin Access to the Gateway Exposes
Okta Access Gateway sits in front of on-premises applications, brokering sign-in to them. Administrative access to the gateway can expose the on-premises apps behind it, because the gateway controls how users are authenticated into those applications.
Okta reported no attacks on OAG exploiting these flaws. The company has not attributed the discovery of the bugs to a named researcher in the material available so far, and it has not published exploit details.
How the Two Bugs Fit Together
The sequence the advisories describe is a staged path. Under CVE-2026-115546, a low-level session holder might change the authentication source to gain Admin Console access. With that access, CVE-2026-115547 would allow system command execution as the service account. Okta has not said that the two have been chained in any attack, and the gateway maker states that it has seen no exploitation, so the combination remains a description of what the flaws permit rather than an observed technique.
Fixed Releases and Where Customers Stand
The company’s update path is OAG 2026.44.0 for customers on the current release line and 2026.10.2 for the other supported line. Okta’s guidance includes reviewing Admin Console access for unexpected logins, which is the signal most relevant to the authentication source flaw.
The disclosure follows the pattern of identity vendors publishing grouped advisories covering multiple CVEs at once. The only CVSS 9.1 item in the set requires administrator privileges, which limits its reach compared with the unauthenticated flaws reported in other products this week, though the 8.1-rated companion flaw lowers the privilege needed to approach that position.
