CVE-2026-78550 Improper Input Handling in Okta Access Gateway Management Console Exception Handler
An authenticated administrator can execute arbitrary code via unsanitized input in the Okta Access Gateway management console.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-78550?
CVE-2026-78550 is a medium-severity code injection vulnerability in Okta Access Gateway, published on 8 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.
Weakness: CWE-95
Which versions are affected by CVE-2026-78550?
It affects 1 product.
Products include Okta Access Gateway.
How do I fix CVE-2026-78550?
No fix has been published for CVE-2026-78550 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-78550 being exploited?
There is no known exploitation of CVE-2026-78550 in the wild and no public exploit code.
Other vulnerabilities in Okta Access Gateway
- CVE-2026-78626 Improper Input Sanitization in Okta Access Gateway Protected Rules
- CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores
- CVE-2026-78579 Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation
- CVE-2026-78625 Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration
- CVE-2026-78630 Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing
Sources
Also known as GHSA-7r5r-h4wq-43gr.