AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaCVE-2026-78624

Okta Access Gateway: path traversal

Okta

CVE-2026-78624 · Published Sep 8, 2026 · updated Sep 22, 2026

Medium4.9
Fix: upgrade to 2026.9.1 or later
Okta advisory

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

Affected versions

PackageAffectedFixed in
Okta Access Gateway
Product
< 2026.9.12026.9.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More Okta advisories

All Okta
Medium 6.7Sep 8Okta Auth0 AD/LDAP Connector: missing authenticationCVE-2026-85981no fix yetCritical 9.0Sep 8Okta Auth0 AD/LDAP Connector: cross-site scriptingCVE-2026-85982no fix yetHigh 7.8Sep 8Okta Auth0 AD/LDAP Connector: code executionCVE-2026-85983no fix yetMedium 6.5Sep 8The react-native-auth0 SDK's web platform implementation does not scope its...CVE-2026-84685fixed in 5.11.1Medium 6.0Sep 8Okta Verify for Windows: link followingCVE-2026-78622fixed in 7.0.0Medium 5.6Sep 8The Okta Hyperdrive agent plugin returns a success response without a signed...CVE-2026-78629fixed in 1.5.2