OktaOKTA-1RLQJQ5

PHP Runtime Vulnerabilities Affecting Okta Access Gateway CVE-2026-109618 /...

CVE-2026-109618 · Published Oct 22, 2026

Critical9.8

No fix yet

Two critical remote code execution vulnerabilities, collectively referred to as PHP2Shell, were disclosed in PHP on October 21, 2026. The Okta Access Gateway includes a PHP runtime component affected by these vulnerabilities. To remediate, upgrade your Okta Access Gateway appliance version to 2026.44.0

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 23Severity: Unrated to Critical

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: NVD
Also known as: CVE-2026-109619

More Okta advisories

All Okta

Critical 9.1Oct 22

Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547 - Oct...CVE-2026-115547no fix yet High 8.1Oct 22

Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546 - Oct 22...CVE-2026-115546no fix yet Medium 6.0Oct 13

Improper Input Validation in the Okta Credential Provider for Windows CVE-2026-78628...CVE-2026-78628no fix yet Medium 5.4Oct 13

Missing Verification of auth_time Claim in auth0.js CVE-2026-107371 - Oct 13, 2026CVE-2026-107371no fix yet Medium 5.3Oct 13

Improper Request Handling for Active Directory Logins in auth0-lock CVE-2026-107370 - Oct...CVE-2026-107370no fix yet Medium 5.3Oct 13

Insecure Default File Permissions in Okta RADIUS Agent Windows Installer CVE-2026-78632...CVE-2026-78632no fix yet