# Okta Access Gateway vulnerabilities Source: https://junglewise.ai/threats/technologies/access-gateway Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/access-gateway.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in Okta Access Gateway: 0 in the last 7 days and 13 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115547, was published on 23 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 13 - All time: 13 (1 critical, 0 exploited in the wild) ## About Okta Access Gateway Okta network appliance that provides secure remote access to on-premises resources. ## Latest Okta Access Gateway vulnerabilities - [CVE-2026-115547: Okta Access Gateway command execution in Admin Console](https://junglewise.ai/threats/cve-2026-115547-an-input-validation-issue-in-the-okta-access-gateway-oag-admin) (critical, CVSS 9.1, published 23 Oct 2026) - [CVE-2026-115546: Okta Access Gateway authentication source validation bypass](https://junglewise.ai/threats/cve-2026-115546-okta-access-gateway-oag-does-not-validate-the-selected) (high, CVSS 8.1, published 23 Oct 2026) - [CVE-2026-78630: Okta Access Gateway OS command injection in SNMP configuration](https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78626: Okta Access Gateway authorization bypass in Protected Rules](https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules) (high, CVSS 8.1, published 8 Sep 2026) - [CVE-2026-78625: Okta Access Gateway code injection in dashboard labels](https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78624: Okta Access Gateway path traversal in backup restore](https://junglewise.ai/threats/cve-2026-78624-okta-access-gateway-path-traversal-in-backup-restore) (medium, CVSS 4.9, published 8 Sep 2026) - [CVE-2026-78623: Okta Access Gateway SQL injection in SAML assertion handling](https://junglewise.ai/threats/cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling) (high, CVSS 7.7, published 8 Sep 2026) - [CVE-2026-78620: Okta Access Gateway arbitrary file write in Kerberos configuration handler](https://junglewise.ai/threats/cve-2026-78620-okta-access-gateway-arbitrary-file-write-in-kerberos) (medium, CVSS 5.9, published 8 Sep 2026) - [CVE-2026-78579: Okta Access Gateway LDAP injection in datastore filter](https://junglewise.ai/threats/cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter) (medium, CVSS 6.8, published 8 Sep 2026) - [CVE-2026-78560: Okta Access Gateway authentication bypass in pass-through source](https://junglewise.ai/threats/cve-2026-78560-okta-access-gateway-authentication-bypass-in-pass-through-source) (medium, CVSS 4.8, published 8 Sep 2026) - [CVE-2026-78552: Okta Access Gateway validation bypass in custom directives](https://junglewise.ai/threats/cve-2026-78552-okta-access-gateway-validation-bypass-in-custom-directives) (medium, CVSS 6, published 8 Sep 2026) - [CVE-2026-78550: Okta Access Gateway code injection in management console](https://junglewise.ai/threats/cve-2026-78550-okta-access-gateway-code-injection-in-management-console) (medium, CVSS 6.6, published 8 Sep 2026) - [CVE-2026-78545: Okta Access Gateway code injection in application label](https://junglewise.ai/threats/cve-2026-78545-okta-access-gateway-code-injection-in-application-label) (medium, CVSS 6.6, published 8 Sep 2026) ## Most severe Okta Access Gateway vulnerabilities - [CVE-2026-115547: Okta Access Gateway command execution in Admin Console](https://junglewise.ai/threats/cve-2026-115547-an-input-validation-issue-in-the-okta-access-gateway-oag-admin) (critical, CVSS 9.1, published 23 Oct 2026) - [CVE-2026-78626: Okta Access Gateway authorization bypass in Protected Rules](https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules) (high, CVSS 8.1, published 8 Sep 2026) - [CVE-2026-115546: Okta Access Gateway authentication source validation bypass](https://junglewise.ai/threats/cve-2026-115546-okta-access-gateway-oag-does-not-validate-the-selected) (high, CVSS 8.1, published 23 Oct 2026) - [CVE-2026-78623: Okta Access Gateway SQL injection in SAML assertion handling](https://junglewise.ai/threats/cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling) (high, CVSS 7.7, published 8 Sep 2026) - [CVE-2026-78579: Okta Access Gateway LDAP injection in datastore filter](https://junglewise.ai/threats/cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter) (medium, CVSS 6.8, published 8 Sep 2026) - [CVE-2026-78625: Okta Access Gateway code injection in dashboard labels](https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78630: Okta Access Gateway OS command injection in SNMP configuration](https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78550: Okta Access Gateway code injection in management console](https://junglewise.ai/threats/cve-2026-78550-okta-access-gateway-code-injection-in-management-console) (medium, CVSS 6.6, published 8 Sep 2026) - [CVE-2026-78545: Okta Access Gateway code injection in application label](https://junglewise.ai/threats/cve-2026-78545-okta-access-gateway-code-injection-in-application-label) (medium, CVSS 6.6, published 8 Sep 2026) - [CVE-2026-78552: Okta Access Gateway validation bypass in custom directives](https://junglewise.ai/threats/cve-2026-78552-okta-access-gateway-validation-bypass-in-custom-directives) (medium, CVSS 6, published 8 Sep 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 11 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Okta technologies - [Okta Hyperdrive](https://junglewise.ai/threats/technologies/hyperdrive): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Okta Access Gateway vulnerabilities", https://junglewise.ai/threats/technologies/access-gateway, 9 November 2026.