Okta patches critical Access Gateway flaw allowing system command execution
The vulnerability allows authenticated administrators to execute commands; CISA reports no active exploitation as of Oct. 23.
Key figures
| CVE-2026-115547 CVSS base score | 9.1 |
|---|---|
| PHP internet power share | nearly 70% |
| CVE-2026-115547 impact subscore | 6.0 |
| CVE-2026-115547 exploitability subscore | 2.3 |
| Okta stock price (Oct. 23) | $209.48 |
| Identity platforms targeted in ransomware attacks | 87% |
Okta has patched a critical code injection vulnerability in its Access Gateway (OAG) that allows authenticated administrators to execute system commands [1]. The flaw, tracked as CVE-2026-115547, carries a CVSS base score of 9.1 [1].
The vulnerability occurs when the OAG Admin Console processes specially formatted configuration values [1]. An attacker with administrative access can execute commands under the context of the OAG service account [1].
This flaw arrives as the cybersecurity sector faces AI-enabled threats dubbed "Black October" [5]. U.S. security agencies, including the National Security Agency and FBI, issued warnings about critical vulnerabilities in PHP—the language powering nearly 70% of the internet—that were discovered using advanced AI models [5].
Technical impact and remediation
The National Vulnerability Database record for CVE-2026-115547 shows an impact subscore of 6.0 and an exploitability subscore of 2.3 [1]. The vulnerability affects all Okta Access Gateway versions prior to 2026.10.2 [1, 7].
Okta's security advisory identifies the issue as code injection and lists upgrading to version 2026.10.2 or later as the only remediation [1, 7]. No workaround is provided [1].
CISA's Stakeholder-Specific Vulnerability Categorization assessment, timestamped 10:46 UTC on Oct. 23, 2026, rates the technical impact as total but lists exploitation as "none" [1].
Market and industry context
Okta's stock rose 4% to $209.48 on Oct. 23 [4]. This rally followed an Evercore ISI channel survey that found Okta had the strongest pipeline momentum among covered security vendors [4].
Financial writer David Moadel noted that "gains built on survey data can fade if vendor reports show slower deal conversion" [4].
Identity systems remain high-priority targets. Tomer Bar, a security research executive at Semperis, warned that "attackers with suitable permissions can use Active Directory to move between machines and encrypt systems" [9].
To address AI risks, Okta is incorporating support for NVIDIA's OpenShell Reference Architecture to provide authentication controls for autonomous AI agents [2, 5].
What we don't know
- Which specific configuration field in the Admin Console is vulnerable?
- What is an example payload that could be used to exploit the flaw?
- Has any exploitation occurred since CISA's Oct. 23 timestamp?
Sources
- Okta Fixes CVE-2026-115547 in Access Gateway — sqmagazine.co.uk, Oct 23, 2026
- Cybersecurity Stocks Rise as Evercore Survey Flags Strengthening Demand: Okta, CrowdStrike and Palo Alto Climb 4% — 247wallst.com, Oct 23, 2026
- Qualys, Tenable, Cloudflare, CrowdStrike, and Okta shares skyrocket ... — markets.financialcontent.com, Oct 23, 2026
- 87% of Ransomware Attacks Target Active Directory, Entra ID and Okta — cyberpress.org
