{"schema_version":1,"title":"Okta vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 21 vulnerabilities in Okta: 0 in the last 7 days and 18 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-78635, was published on 8 September 2026. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/okta","json_url":"https://junglewise.ai/threats/vendors/okta.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/okta","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":5,"all_time":21,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":17,"last_90_days":18,"last_365_days":20},"latest":[{"cve":"CVE-2026-78635","cvss":5,"epss":0.002,"slug":"cve-2026-78635-okta-privileged-access-client-argument-injection-in-url-handler","title":"Okta Privileged Access client argument injection in URL handler","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:41.68+00:00","url":"https://junglewise.ai/threats/cve-2026-78635-okta-privileged-access-client-argument-injection-in-url-handler"},{"cve":"CVE-2026-78631","cvss":5.3,"epss":0.0014,"slug":"cve-2026-78631-okta-hyperdrive-agent-sensitive-data-exposure-in-logging","title":"Okta Hyperdrive Agent sensitive data exposure in logging","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:41.57+00:00","url":"https://junglewise.ai/threats/cve-2026-78631-okta-hyperdrive-agent-sensitive-data-exposure-in-logging"},{"cve":"CVE-2026-78630","cvss":6.7,"epss":0.0022,"slug":"cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration","title":"Okta Access Gateway OS command injection in SNMP configuration","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:41.457+00:00","url":"https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration"},{"cve":"CVE-2026-78629","cvss":5.6,"epss":0.0014,"slug":"cve-2026-78629-okta-hyperdrive-agent-improper-authentication-verification-in-mfa","title":"Okta Hyperdrive agent improper authentication verification in MFA response","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:41.347+00:00","url":"https://junglewise.ai/threats/cve-2026-78629-okta-hyperdrive-agent-improper-authentication-verification-in-mfa"},{"cve":"CVE-2026-78622","cvss":6,"epss":0.0013,"slug":"cve-2026-78622-okta-verify-for-windows-improper-link-resolution-in-uninstaller","title":"Okta Verify for Windows improper link resolution in uninstaller","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:41.233+00:00","url":"https://junglewise.ai/threats/cve-2026-78622-okta-verify-for-windows-improper-link-resolution-in-uninstaller"},{"cve":"CVE-2026-78627","cvss":7.3,"epss":0.0014,"slug":"cve-2026-78627-okta-hyperdrive-integration-installer-logs-oauth-client-secret-in","title":"Okta Hyperdrive Integration installer logs OAuth client secret in plaintext","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:38.44+00:00","url":"https://junglewise.ai/threats/cve-2026-78627-okta-hyperdrive-integration-installer-logs-oauth-client-secret-in"},{"cve":"CVE-2026-78626","cvss":8.1,"epss":0.0036,"slug":"cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules","title":"Okta Access Gateway authorization bypass in Protected Rules","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:38.07+00:00","url":"https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules"},{"cve":"CVE-2026-78625","cvss":6.7,"epss":0.0023,"slug":"cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels","title":"Okta Access Gateway code injection in dashboard labels","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:37.647+00:00","url":"https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels"},{"cve":"CVE-2026-78624","cvss":4.9,"epss":0.0046,"slug":"cve-2026-78624-okta-access-gateway-path-traversal-in-backup-restore","title":"Okta Access Gateway path traversal in backup restore","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:37.397+00:00","url":"https://junglewise.ai/threats/cve-2026-78624-okta-access-gateway-path-traversal-in-backup-restore"},{"cve":"CVE-2026-78623","cvss":7.7,"epss":0.0045,"slug":"cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling","title":"Okta Access Gateway SQL injection in SAML assertion handling","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:37.05+00:00","url":"https://junglewise.ai/threats/cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling"},{"cve":"CVE-2026-78620","cvss":5.9,"epss":0.0034,"slug":"cve-2026-78620-okta-access-gateway-arbitrary-file-write-in-kerberos","title":"Okta Access Gateway arbitrary file write in Kerberos configuration handler","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:36.777+00:00","url":"https://junglewise.ai/threats/cve-2026-78620-okta-access-gateway-arbitrary-file-write-in-kerberos"},{"cve":"CVE-2026-78579","cvss":6.8,"epss":0.0024,"slug":"cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter","title":"Okta Access Gateway LDAP injection in datastore filter","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:36.59+00:00","url":"https://junglewise.ai/threats/cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter"},{"cve":"CVE-2026-78574","cvss":7.5,"epss":0.001,"slug":"cve-2026-78574-okta-hyperdrive-integration-plugin-improper-assembly-resolution","title":"Okta Hyperdrive Integration plugin improper assembly resolution","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:36.417+00:00","url":"https://junglewise.ai/threats/cve-2026-78574-okta-hyperdrive-integration-plugin-improper-assembly-resolution"},{"cve":"CVE-2026-78560","cvss":4.8,"epss":0.002,"slug":"cve-2026-78560-okta-access-gateway-authentication-bypass-in-pass-through-source","title":"Okta Access Gateway authentication bypass in pass-through source","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:36.22+00:00","url":"https://junglewise.ai/threats/cve-2026-78560-okta-access-gateway-authentication-bypass-in-pass-through-source"},{"cve":"CVE-2026-78552","cvss":6,"epss":0.0027,"slug":"cve-2026-78552-okta-access-gateway-validation-bypass-in-custom-directives","title":"Okta Access Gateway validation bypass in custom directives","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:36.073+00:00","url":"https://junglewise.ai/threats/cve-2026-78552-okta-access-gateway-validation-bypass-in-custom-directives"},{"cve":"CVE-2026-78550","cvss":6.6,"epss":0.0049,"slug":"cve-2026-78550-okta-access-gateway-code-injection-in-management-console","title":"Okta Access Gateway code injection in management console","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:35.937+00:00","url":"https://junglewise.ai/threats/cve-2026-78550-okta-access-gateway-code-injection-in-management-console"},{"cve":"CVE-2026-78545","cvss":6.6,"epss":0.0049,"slug":"cve-2026-78545-okta-access-gateway-code-injection-in-application-label","title":"Okta Access Gateway code injection in application label","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:35.727+00:00","url":"https://junglewise.ai/threats/cve-2026-78545-okta-access-gateway-code-injection-in-application-label"},{"cve":"CVE-2026-77585","cvss":5.3,"epss":0.0014,"slug":"cve-2026-77585-okta-privileged-access-client-command-injection-via-ssh-username","title":"Okta Privileged Access client command injection via SSH username","severity":"medium","exploited":false,"published_at":"2026-08-25T20:17:06.477+00:00","url":"https://junglewise.ai/threats/cve-2026-77585-okta-privileged-access-client-command-injection-via-ssh-username"},{"cve":"CVE-2025-67505","cvss":8.4,"epss":0.0021,"slug":"cve-2025-67505-okta-java-sdk-race-condition-in-apiclient","title":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise","severity":"high","exploited":false,"published_at":"2025-12-10T23:15:48.667+00:00","url":"https://junglewise.ai/threats/cve-2025-67505-okta-java-sdk-race-condition-in-apiclient"},{"cve":"CVE-2025-66033","cvss":5.3,"epss":0.0027,"slug":"cve-2025-66033-okta-java-management-sdk-facilitates-interactions-with-the-okta","title":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded im","severity":"medium","exploited":false,"published_at":"2025-12-10T22:16:27.52+00:00","url":"https://junglewise.ai/threats/cve-2025-66033-okta-java-management-sdk-facilitates-interactions-with-the-okta"},{"cve":"CVE-2022-3145","cvss":3.1,"epss":0.0041,"slug":"cve-2022-3145-okta-oidc-middleware-open-redirect-vulnerability","title":"Okta OIDC Middleware open redirect vulnerability","severity":"low","exploited":false,"published_at":"2023-01-09T20:06:02+00:00","url":"https://junglewise.ai/threats/cve-2022-3145-okta-oidc-middleware-open-redirect-vulnerability"}],"vendor":{"hub":true,"name":"Okta","slug":"okta","description":"Cloud-based identity and access management platform.","url":"https://junglewise.ai/threats/vendors/okta"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":17},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2025-67505","cvss":8.4,"epss":0.0021,"slug":"cve-2025-67505-okta-java-sdk-race-condition-in-apiclient","title":"Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise","severity":"high","exploited":false,"published_at":"2025-12-10T23:15:48.667+00:00","url":"https://junglewise.ai/threats/cve-2025-67505-okta-java-sdk-race-condition-in-apiclient"},{"cve":"CVE-2026-78626","cvss":8.1,"epss":0.0036,"slug":"cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules","title":"Okta Access Gateway authorization bypass in Protected Rules","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:38.07+00:00","url":"https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules"},{"cve":"CVE-2026-78623","cvss":7.7,"epss":0.0045,"slug":"cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling","title":"Okta Access Gateway SQL injection in SAML assertion handling","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:37.05+00:00","url":"https://junglewise.ai/threats/cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling"},{"cve":"CVE-2026-78574","cvss":7.5,"epss":0.001,"slug":"cve-2026-78574-okta-hyperdrive-integration-plugin-improper-assembly-resolution","title":"Okta Hyperdrive Integration plugin improper assembly resolution","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:36.417+00:00","url":"https://junglewise.ai/threats/cve-2026-78574-okta-hyperdrive-integration-plugin-improper-assembly-resolution"},{"cve":"CVE-2026-78627","cvss":7.3,"epss":0.0014,"slug":"cve-2026-78627-okta-hyperdrive-integration-installer-logs-oauth-client-secret-in","title":"Okta Hyperdrive Integration installer logs OAuth client secret in plaintext","severity":"high","exploited":false,"published_at":"2026-09-08T20:18:38.44+00:00","url":"https://junglewise.ai/threats/cve-2026-78627-okta-hyperdrive-integration-installer-logs-oauth-client-secret-in"},{"cve":"CVE-2026-78579","cvss":6.8,"epss":0.0024,"slug":"cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter","title":"Okta Access Gateway LDAP injection in datastore filter","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:36.59+00:00","url":"https://junglewise.ai/threats/cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter"},{"cve":"CVE-2026-78625","cvss":6.7,"epss":0.0023,"slug":"cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels","title":"Okta Access Gateway code injection in dashboard labels","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:37.647+00:00","url":"https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels"},{"cve":"CVE-2026-78630","cvss":6.7,"epss":0.0022,"slug":"cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration","title":"Okta Access Gateway OS command injection in SNMP configuration","severity":"medium","exploited":false,"published_at":"2026-09-08T21:18:41.457+00:00","url":"https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration"},{"cve":"CVE-2026-78550","cvss":6.6,"epss":0.0049,"slug":"cve-2026-78550-okta-access-gateway-code-injection-in-management-console","title":"Okta Access Gateway code injection in management console","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:35.937+00:00","url":"https://junglewise.ai/threats/cve-2026-78550-okta-access-gateway-code-injection-in-management-console"},{"cve":"CVE-2026-78545","cvss":6.6,"epss":0.0049,"slug":"cve-2026-78545-okta-access-gateway-code-injection-in-application-label","title":"Okta Access Gateway code injection in application label","severity":"medium","exploited":false,"published_at":"2026-09-08T20:18:35.727+00:00","url":"https://junglewise.ai/threats/cve-2026-78545-okta-access-gateway-code-injection-in-application-label"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Okta Access Gateway","slug":"access-gateway","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/access-gateway"},{"name":"Okta Hyperdrive","slug":"hyperdrive","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/hyperdrive"}]}