Executive brief
The Okta Access Gateway appliance is a security gateway used to control network access and protect enterprise resources. The management console contains a code injection vulnerability that allows authenticated SSH administrators to execute arbitrary code with management console privileges by passing unsanitized input to a code evaluation function. An attacker with valid SSH credentials can compromise the appliance and gain full control of network access controls.
Technical details
The vulnerability is a code injection flaw (CWE-95) in the Okta Access Gateway management console exception handler. User-supplied input is passed directly to eval() without sanitization during an authenticated SSH management session. The attack requires valid SSH credentials for the management account and network access to the SSH management interface, both typically restricted to local network environments. Successful exploitation results in arbitrary code execution with the privileges of the management console process. The vulnerability is resolved in version 2026.9.1; customers must upgrade from versions prior to 2026.9.1.
Affected products
- Okta Access Gateway prior to 2026.9.1
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fix available in version 2026.9.1