OktaCVE-2026-78625

Okta Access Gateway: code injection

CVE-2026-78625 · Published Sep 8, 2026 · updated Sep 22, 2026

Medium6.7

Fix: upgrade to 2026.9.1 or later

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process.

Affected versions

Package	Affected	Fixed in
Okta Access Gateway Product	< 2026.9.1	2026.9.1

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-94

More Okta advisories

All Okta

Medium 6.7Sep 8

Okta Auth0 AD/LDAP Connector: missing authenticationCVE-2026-85981no fix yet Critical 9.0Sep 8

Okta Auth0 AD/LDAP Connector: cross-site scriptingCVE-2026-85982no fix yet High 7.8Sep 8

Okta Auth0 AD/LDAP Connector: code executionCVE-2026-85983no fix yet Medium 6.5Sep 8

The react-native-auth0 SDK's web platform implementation does not scope its...CVE-2026-84685fixed in 5.11.1 Medium 6.0Sep 8

Okta Verify for Windows: link followingCVE-2026-78622fixed in 7.0.0 Medium 5.6Sep 8

The Okta Hyperdrive agent plugin returns a success response without a signed...CVE-2026-78629fixed in 1.5.2