Okta Access Gateway · Disclosed

Okta patches command execution and authentication bypass in Access Gateway

Oct 21, 2026 · 1 min read

On October 22, 2026 Okta published fixes for the Access Gateway: command execution via Admin Console input (CVE-2026-115547) and an authentication bypass that may generate a SAML assertion granting Admin Console access (CVE-2026-115546), both resolved in version 2026.10.2. Version 2026.44.0 bundles PHP 8.3.36 and resolves PHP2Shell (CVE-2026-109618 and CVE-2026-109619); Okta says public PoC exploits achieved no code execution in the default configuration. On-premises customers should upgrade to 2026.44.0, as Okta recommends.

By HIFY Radar newsroom Updated 10/26/2026 01:11 PM Get this every day →← Back to the feed 2 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Okta fixed flaws in the Access Gateway, the on-premises appliance that authenticates access to applications. One flaw allowed command execution through Admin Console input and another allowed an authentication bypass reaching the console. There are also critical PHP flaws bundled in the product, called PHP2Shell. Fixes are in versions 2026.10.2 and 2026.44.0.

Why it matters

The Access Gateway concentrates employee sign-on to corporate systems; flaws in its admin console could compromise access control company-wide. Okta says Okta and Auth0 cloud services are not affected; the risk sits on on-premises appliances. Okta tested public PoC exploits for PHP2Shell and none achieved code execution in the product's default configuration.

What to do

Upgrade the appliance to version 2026.44.0 or greater; this meets the 2026.10.2 minimum for the two OAG CVEs and includes PHP 8.3.36. Then review authentication sources configured on the gateway and Admin Console access logs.

For the technical team

CVE: CVE-2026-115547, CVE-2026-115546
Affected: Okta Access Gateway (appliance on-premises) · Okta Access Gateway before 2026.10.2 (CVE-2026-115547 and CVE-2026-115546); OAG running PHP 8.3.x before 8.3.36, i.e. appliance versions before 2026.44.0 (PHP2Shell).
Exploitation: Okta reports testing the publicly available PoC exploits for PHP2Shell against OAG in its default configuration; none achieved code execution, and the default configuration mitigates known exploitation. The sources report no in-the-wild exploitation for any of these CVEs.
Fix: Upgrading the OAG appliance to 2026.10.2 or greater resolves CVE-2026-115547 and CVE-2026-115546. Version 2026.44.0 includes PHP 8.3.36 and resolves PHP2Shell; Okta recommends 2026.44.0.
Vector: CVE-2026-115547: command execution via Admin Console input in OAG (reference severity: critical). CVE-2026-115546: authentication bypass; OAG does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter and may generate a SAML assertion granting Admin Console access (CWE-639 and CWE-287; CVSS 3.1: 8.1). PHP2Shell: pre-authentication RCE in the PHP 8.3.x runtime bundled with OAG (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2 each).
More details: Advisories published October 22, 2026; PHP2Shell disclosed October 21, 2026 as industry-wide third-party PHP flaws. Okta and Auth0 cloud services are not affected by PHP2Shell. Precondition for CVE-2026-115546: a valid session for any authentication source configured on the gateway. CVSS vector for CVE-2026-115546: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.