Okta Access Gateway Auth and Code Injection

Authenticated administrators of Okta Access Gateway can execute system commands as the OAG service account by submitting specially formatted values to Admin Console configuration inputs that are processed without adequate validation. The flaw is rated CVSS 9.1 with a PR:H vector, so exploitation requires high-privileged Admin Console access rather than an unauthenticated or low-privileged foothold; exact affected version ranges are not enumerated in the supplied data. No public exploit was identified at time of analysis, but the act_now priority and scope change to the host OS make prompt review of the Okta advisory important.

Privilege escalation in Okta Access Gateway allows an already authenticated user with an active session to obtain Admin Console access by altering the authentication-source parameter during sign-on, which OAG fails to validate before issuing a SAML assertion. Okta rates the flaw 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while our assessment adjusts the privilege requirement to PR:L because valid credentials and a live session are mandatory; the AC:H metric reflects that the parameter manipulation is not trivial to perform reliably. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but successful abuse grants administrative control of the gateway, so it warrants prompt patching on this week's cycle rather than emergency action.