EUVD-2026-74172
GHSA-5fhg-v2mq-37m7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Write-based path traversal maps to I:H not C:H; no read primitive described; admin-level restore access confirms PR:H; incidental file overwrites may affect availability at A:L.
Primary rating from Vendor (okta).
CVSS VectorVendor: okta
Lifecycle Timeline
3DescriptionCVE.org
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.
AnalysisAI
Path traversal in Okta Access Gateway's backup restore function (all versions prior to 2026.9.1) allows an authenticated administrator to supply a crafted encrypted backup payload containing a malicious embedded filename, causing the appliance to write file contents to arbitrary locations on its filesystem. Exploitation requires high-privilege administrative access (CVSS PR:H), materially limiting the attacker population to those who have already compromised gateway admin credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active administrative session on the Okta Access Gateway management interface, confirmed by the CVSS PR:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.9 score and PR:H vector reflect the dominant risk-reduction factor: exploitation requires administrative credentials to the gateway management interface, constraining the realistic attacker pool to insiders, credential-theft actors, or those who have achieved prior compromise of admin accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Okta Access Gateway to version 2026.9.1 or later per the vendor advisory at https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today