# Okta vulnerabilities Source: https://junglewise.ai/threats/vendors/okta Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/okta.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in Okta: 0 in the last 7 days and 23 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115547, was published on 23 October 2026. 5 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 23 - All time: 26 (1 critical, 0 exploited in the wild) ## About Okta Okta provides cloud-based identity and access management services for enterprises. ## Latest Okta vulnerabilities - [CVE-2026-115547: Okta Access Gateway command execution in Admin Console](https://junglewise.ai/threats/cve-2026-115547-an-input-validation-issue-in-the-okta-access-gateway-oag-admin) (critical, CVSS 9.1, published 23 Oct 2026) - [CVE-2026-115546: Okta Access Gateway authentication source validation bypass](https://junglewise.ai/threats/cve-2026-115546-okta-access-gateway-oag-does-not-validate-the-selected) (high, CVSS 8.1, published 23 Oct 2026) - [CVE-2026-78633: Okta RADIUS Agent denial of service in packet parser](https://junglewise.ai/threats/cve-2026-78633-the-okta-radius-agent-does-not-validate-the-sub-attribute-length) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-78632: Okta RADIUS Agent insecure file permissions in Windows installer](https://junglewise.ai/threats/cve-2026-78632-the-okta-radius-agent-windows-installer-assigns-write-permissions) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-78628: Okta Credential Provider for Windows input validation flaw](https://junglewise.ai/threats/cve-2026-78628-the-okta-credential-provider-for-windows-does-not-validate-a) (medium, CVSS 6, published 13 Oct 2026) - [CVE-2026-78635: Okta Privileged Access client argument injection in URL handler](https://junglewise.ai/threats/cve-2026-78635-okta-privileged-access-client-argument-injection-in-url-handler) (medium, CVSS 5, published 8 Sep 2026) - [CVE-2026-78631: Okta Hyperdrive Agent sensitive data exposure in logging](https://junglewise.ai/threats/cve-2026-78631-okta-hyperdrive-agent-sensitive-data-exposure-in-logging) (medium, CVSS 5.3, published 8 Sep 2026) - [CVE-2026-78630: Okta Access Gateway OS command injection in SNMP configuration](https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78629: Okta Hyperdrive agent improper authentication verification in MFA response](https://junglewise.ai/threats/cve-2026-78629-okta-hyperdrive-agent-improper-authentication-verification-in-mfa) (medium, CVSS 5.6, published 8 Sep 2026) - [CVE-2026-78622: Okta Verify for Windows improper link resolution in uninstaller](https://junglewise.ai/threats/cve-2026-78622-okta-verify-for-windows-improper-link-resolution-in-uninstaller) (medium, CVSS 6, published 8 Sep 2026) - [CVE-2026-78627: Okta Hyperdrive Integration installer logs OAuth client secret in plaintext](https://junglewise.ai/threats/cve-2026-78627-okta-hyperdrive-integration-installer-logs-oauth-client-secret-in) (high, CVSS 7.3, published 8 Sep 2026) - [CVE-2026-78626: Okta Access Gateway authorization bypass in Protected Rules](https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules) (high, CVSS 8.1, published 8 Sep 2026) - [CVE-2026-78625: Okta Access Gateway code injection in dashboard labels](https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78624: Okta Access Gateway path traversal in backup restore](https://junglewise.ai/threats/cve-2026-78624-okta-access-gateway-path-traversal-in-backup-restore) (medium, CVSS 4.9, published 8 Sep 2026) - [CVE-2026-78623: Okta Access Gateway SQL injection in SAML assertion handling](https://junglewise.ai/threats/cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling) (high, CVSS 7.7, published 8 Sep 2026) - [CVE-2026-78620: Okta Access Gateway arbitrary file write in Kerberos configuration handler](https://junglewise.ai/threats/cve-2026-78620-okta-access-gateway-arbitrary-file-write-in-kerberos) (medium, CVSS 5.9, published 8 Sep 2026) - [CVE-2026-78579: Okta Access Gateway LDAP injection in datastore filter](https://junglewise.ai/threats/cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter) (medium, CVSS 6.8, published 8 Sep 2026) - [CVE-2026-78574: Okta Hyperdrive Integration plugin improper assembly resolution](https://junglewise.ai/threats/cve-2026-78574-okta-hyperdrive-integration-plugin-improper-assembly-resolution) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-78560: Okta Access Gateway authentication bypass in pass-through source](https://junglewise.ai/threats/cve-2026-78560-okta-access-gateway-authentication-bypass-in-pass-through-source) (medium, CVSS 4.8, published 8 Sep 2026) - [CVE-2026-78552: Okta Access Gateway validation bypass in custom directives](https://junglewise.ai/threats/cve-2026-78552-okta-access-gateway-validation-bypass-in-custom-directives) (medium, CVSS 6, published 8 Sep 2026) - [CVE-2026-78550: Okta Access Gateway code injection in management console](https://junglewise.ai/threats/cve-2026-78550-okta-access-gateway-code-injection-in-management-console) (medium, CVSS 6.6, published 8 Sep 2026) - [CVE-2026-78545: Okta Access Gateway code injection in application label](https://junglewise.ai/threats/cve-2026-78545-okta-access-gateway-code-injection-in-application-label) (medium, CVSS 6.6, published 8 Sep 2026) - [CVE-2026-77585: Okta Privileged Access client command injection via SSH username](https://junglewise.ai/threats/cve-2026-77585-okta-privileged-access-client-command-injection-via-ssh-username) (medium, CVSS 5.3, published 25 Aug 2026) - [CVE-2025-67505: Okta Java SDK race condition in ApiClient](https://junglewise.ai/threats/cve-2025-67505-okta-java-sdk-race-condition-in-apiclient) (high, CVSS 8.4, published 10 Dec 2025) - [CVE-2025-66033: Improper Memory Cleanup in the Okta Java SDK](https://junglewise.ai/threats/cve-2025-66033-okta-java-management-sdk-facilitates-interactions-with-the-okta) (medium, CVSS 5.3, published 10 Dec 2025) ## Most severe Okta vulnerabilities - [CVE-2026-115547: Okta Access Gateway command execution in Admin Console](https://junglewise.ai/threats/cve-2026-115547-an-input-validation-issue-in-the-okta-access-gateway-oag-admin) (critical, CVSS 9.1, published 23 Oct 2026) - [CVE-2025-67505: Okta Java SDK race condition in ApiClient](https://junglewise.ai/threats/cve-2025-67505-okta-java-sdk-race-condition-in-apiclient) (high, CVSS 8.4, published 10 Dec 2025) - [CVE-2026-78626: Okta Access Gateway authorization bypass in Protected Rules](https://junglewise.ai/threats/cve-2026-78626-okta-access-gateway-authorization-bypass-in-protected-rules) (high, CVSS 8.1, published 8 Sep 2026) - [CVE-2026-115546: Okta Access Gateway authentication source validation bypass](https://junglewise.ai/threats/cve-2026-115546-okta-access-gateway-oag-does-not-validate-the-selected) (high, CVSS 8.1, published 23 Oct 2026) - [CVE-2026-78623: Okta Access Gateway SQL injection in SAML assertion handling](https://junglewise.ai/threats/cve-2026-78623-okta-access-gateway-sql-injection-in-saml-assertion-handling) (high, CVSS 7.7, published 8 Sep 2026) - [CVE-2026-78574: Okta Hyperdrive Integration plugin improper assembly resolution](https://junglewise.ai/threats/cve-2026-78574-okta-hyperdrive-integration-plugin-improper-assembly-resolution) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-78627: Okta Hyperdrive Integration installer logs OAuth client secret in plaintext](https://junglewise.ai/threats/cve-2026-78627-okta-hyperdrive-integration-installer-logs-oauth-client-secret-in) (high, CVSS 7.3, published 8 Sep 2026) - [CVE-2026-78579: Okta Access Gateway LDAP injection in datastore filter](https://junglewise.ai/threats/cve-2026-78579-okta-access-gateway-ldap-injection-in-datastore-filter) (medium, CVSS 6.8, published 8 Sep 2026) - [CVE-2026-78625: Okta Access Gateway code injection in dashboard labels](https://junglewise.ai/threats/cve-2026-78625-okta-access-gateway-code-injection-in-dashboard-labels) (medium, CVSS 6.7, published 8 Sep 2026) - [CVE-2026-78630: Okta Access Gateway OS command injection in SNMP configuration](https://junglewise.ai/threats/cve-2026-78630-okta-access-gateway-os-command-injection-in-snmp-configuration) (medium, CVSS 6.7, published 8 Sep 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 17 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 2 | 1 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Okta technologies - [Okta Access Gateway](https://junglewise.ai/threats/technologies/access-gateway): 13 vulnerabilities - [Okta Hyperdrive](https://junglewise.ai/threats/technologies/hyperdrive): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Okta vulnerabilities", https://junglewise.ai/threats/vendors/okta, 13 November 2026.