[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUlg1p4EqoVO9YVXuTy_iHip1tRpHjMe9S3w43VkKy9c":3},{"article":4,"iocs":41,"watch_terms":54,"solutions":55,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"c163a865-180c-4cb6-b4e5-c9f63881ea41","Okta Patches Critical Access Gateway Flaw CVE-2026-115547","okta-patches-critical-access-gateway-flaw-cve-2026-115547-b96c81","Okta patched CVE-2026-115547, a 9.1-rated Access Gateway Admin Console flaw that lets admins run system commands. Upgrade to 2026.10.2.","Okta has released an update for its Access Gateway product to address a critical vulnerability, CVE-2026-115547, which allows authenticated administrators to execute system commands on the appliance. The flaw, rated 9.1 by CVSS, is an input validation issue in the Admin Console and affects all versions prior to 2026.10.2. A separate authentication bypass vulnerability (CVE-2026-115546) and issues related to PHP2Shell (CVE-2026-109618, CVE-2026-109619) were also patched.","Okta patches critical CVE-2026-115547 flaw allowing admin command execution.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fcve-2026-115547-okta-access-gateway-command-execution.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fokta-bypass.webp","2026-10-24T17:04:14+00:00","2026-10-24T18:00:10.32339+00:00",8,[17,20],{"name":18,"type":19},"Okta Access Gateway","product",{"name":21,"type":22},"Okta","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,49,52],{"type":43,"value":44,"context":45},"cve","CVE-2026-115547","Critical vulnerability allowing admin command execution in Okta Access Gateway.",{"type":43,"value":47,"context":48},"CVE-2026-115546","Authentication bypass vulnerability in Okta Access Gateway.",{"type":43,"value":50,"context":51},"CVE-2026-109618","PHP2Shell critical remote code execution flaw affecting Okta Access Gateway.",{"type":43,"value":53,"context":51},"CVE-2026-109619",[21,18],{"controls":56,"vendors":142},[57,85,113],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":58,"product_name":82,"url":83,"description":84},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":86,"product_name":110,"url":111,"description":112},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[143],{"slug":144,"name":21,"logo_path":145,"roles":146},"okta","\u002Fvendor-logos\u002Fokta.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"okta-access-gateway-critical-rce-flaw-highlights-patch-urgency","Okta Access Gateway Critical RCE Flaw Highlights Patch Urgency","A critical input validation flaw (CVE-2026-115547, CVSS 9.1) in Okta's Access Gateway allowed authenticated administrators to execute arbitrary system commands directly on the appliance, representing a serious privilege escalation and remote code execution risk. The vulnerability resided in the Admin Console, meaning any compromised or malicious admin account could weaponize it to fully compromise the underlying system. Compounding the risk, a separate authentication bypass (CVE-2026-115546) and PHP2Shell-related flaws were disclosed simultaneously, creating a potential chained attack path. This matters because Access Gateway sits at the heart of enterprise identity infrastructure — its compromise could cascade into broader network access for attackers. Organizations running unpatched versions prior to 2026.10.2 remained exposed to complete appliance takeover.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":161,"PCI DSS Requirement 6":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 mandates vulnerability handling and patch management as part of baseline cybersecurity measures for essential entities, directly applicable to the failure to patch a critical identity gateway appliance.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly, which would apply to any Access Gateway in a cardholder data environment.","SI-2 requires organizations to identify, report, and correct information system flaws; a formal flaw remediation process would have ensured prompt upgrade to the patched Access Gateway version.","The root flaw is an input validation vulnerability in an outdated component version; OWASP A06 directly addresses the risk of running software with known, unpatched vulnerabilities.","Regular vulnerability scanning and a defined remediation timeline would have identified CVE-2026-115547 and driven patching of Access Gateway before the flaw could be exploited.","This control requires timely identification and remediation of technical vulnerabilities, which would have mandated patching the Okta Access Gateway before critical flaws were weaponized.","The authentication bypass companion vulnerability (CVE-2026-115546) and the admin-console RCE flaw both underscore the need for robust access control governance on identity infrastructure."]