# CVE-2026-78620: Okta Access Gateway arbitrary file write in Kerberos configuration handler

Source: https://junglewise.ai/threats/cve-2026-78620-okta-access-gateway-arbitrary-file-write-in-kerberos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78620 · Severity: medium · CVSS 5.9 · Published 2026-09-08

Okta Access Gateway is a secure appliance used to authenticate users to on-premises applications via Kerberos. A vulnerability in its Kerberos configuration handler allows authenticated administrators or local attackers to write files to arbitrary locations on the appliance filesystem, potentially compromising system integrity and enabling further attacks on the infrastructure it protects.

Technologies: [Okta Access Gateway](https://junglewise.ai/threats/technologies/access-gateway). Vendors: [Okta](https://junglewise.ai/threats/vendors/okta).

## Quick answers

**Is CVE-2026-78620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78620 being exploited in the wild.

**How severe is CVE-2026-78620?** Medium severity, with a CVSS score of 5.9, published 8 September 2026.

**Which products and versions are affected?** Okta Access Gateway prior to 2026.9.1.

**Is there a fix for CVE-2026-78620?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78620 attacked?** It is attacked over the network or with local access, in a network appliance.

**Am I affected by CVE-2026-78620?** Check whether you run Okta Access Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an arbitrary file write (CWE-73) in the Kerberos configuration handler. The handler accepts file paths from event payloads without validation, using them directly as write destinations. This allows an attacker with authenticated administrative network access or local access to the event pipeline directory (/opt/oag/events) to write malicious files to unintended filesystem locations. An attacker could overwrite critical appliance configuration files, inject malicious code, or establish persistence. The vulnerability is resolved in Okta Access Gateway version 2026.9.1 and later.

## Affected products

- Okta Access Gateway prior to 2026.9.1

## Timeline

- 2026-09-08: disclosed

## References

- [https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620](https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620)

## Related threats

- [Okta Access Gateway command execution in Admin Console](https://junglewise.ai/threats/cve-2026-115547-an-input-validation-issue-in-the-okta-access-gateway-oag-admin)
- [Okta Access Gateway authentication source validation bypass](https://junglewise.ai/threats/cve-2026-115546-okta-access-gateway-oag-does-not-validate-the-selected)
- [Okta Access Gateway OS command injection in SNMP configuration](https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration)
- [Okta Access Gateway authorization bypass in Protected Rules](https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules)
- [Okta Access Gateway code injection in dashboard labels](https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels)