Okta Access Gateway CVE-2026-115547

Exploitation requires an authenticated administrator with access to the Okta Access Gateway Admin Console (PR:H), who must be able to enter 'specially formatted configuration values' into a configuration input that lacks proper validation; the malformed value is then processed and results in OS command execution as the OAG service account. The principal limiting factor is the administrator privilege requirement - this is not exploitable by unauthenticated or low-privileged users and depends on reaching the Admin Console. The precise configuration field and trigger mechanism are not described in the available sources beyond 'input validation issue' and 'specially formatted configuration values'; affected versions and any non-default conditions are not specified in the supplied data.

This is a genuine high-priority issue, but its real-world risk is gated by a significant precondition rather than by raw severity. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) reflects that an attacker who already holds administrator privileges on the Okta Access Gateway Admin Console can trivially (AC:L, no user interaction) achieve a scope-changing full compromise - code execution as the OAG service account with high confidentiality, integrity and availability impact. The high score is driven almost entirely by that impact and the scope change, not by ease of initial access: PR:H means the attacker must first be an authenticated administrator. The vuln.today decision label is 'act_now', consistent with the vendor-confirmed RCE and CWE-94 code-injection classification. However, key exploitation signals are absent from the supplied data: there is no CISA KEV listing, no EPSS probability, and no confirmed public exploit. The only reference is Okta's own security advisory. These signals should be weighed together: the flaw is serious and vendor-confirmed, but it is a post-authentication privilege-escalation-to-RCE issue requiring an existing admin foothold, so it is better characterized as a defense-in-depth / insider-and-post-compromise concern than as a mass-exploitable remote entry point. The 'act_now' label plus confirmed RCE justify prompt patching despite the lack of KEV/EPSS data.

An attacker who has obtained Okta Access Gateway administrator credentials (through phishing, credential reuse, or a malicious/compromised insider) logs into the OAG Admin Console and enters specially formatted values into a configuration field that is not properly validated. The malformed input is processed in a way that injects and runs operating-system commands in the context of the OAG service account, giving the attacker command execution on the gateway host. No public exploit identified at time of analysis; the attack requires existing administrator access (PR:H).