Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| Critical | 9.1 | CVE-2026-115547 |
An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values
OktaOkta Access Gateway
|
NVD | |||
|
CVE-2026-115547An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values
Executive summaryA flaw in the Okta Access Gateway Admin Console lets an authenticated administrator run system commands on the appliance. The advisory rates it 9.1 on the CVSS v3 scale, and the vendor recommends upgrading affected appliances to version 2026.10.2 or greater. Technical summaryThe advisory classifies this as a code injection flaw (CWE-94, with CWE-20 improper input validation) in the Admin Console, where specially formatted configuration values are processed without proper validation. An attacker needs valid administrator credentials for the Admin Console, and the command runs in the context of the OAG service account. Affected versions are those prior to 2026.10.2, and the fixed version is 2026.10.2. The vendor's remediation is to upgrade the appliance to 2026.10.2 or greater. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H with a score of 9.1. No workaround is stated, no detection guidance is stated, and it is not stated whether the flaw is being exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from trust.okta.com/security-advisories/comm…eway-cve-2026-115547 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.1 | CVE-2026-115546 |
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on
OktaOkta Access Gateway
|
NVD | |||
|
CVE-2026-115546Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on
Executive summaryOkta Access Gateway versions prior to 2026.10.2 contain a flaw that lets a signed-in user change the authentication source during sign-on and potentially gain access to the Admin Console. The advisory rates the issue 8.1 on the CVSS v3 scale, and the vendor recommends upgrading the appliance to version 2026.10.2 or later. Technical summaryThe flaw is classified as an authentication bypass, with CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-287 (Improper Authentication) listed. The gateway does not validate the selected authentication source, so an authenticated user with an active session for any configured source can alter that parameter and receive a SAML assertion granting Admin Console access. The advisory states the attack vector as network-reachable with high attack complexity and no privileges or user interaction required, based on the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected versions are those prior to 2026.10.2, and the fixed version is 2026.10.2. No workaround is stated, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from trust.okta.com/security-advisories/auth…eway-cve-2026-115546 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||