CVE-2026-78550

Undergoing Analysis Undergoing Analysis - In Progress

Code Execution in Okta Access Gateway via SSH Session

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Okta

Description

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-78550

Affected Vendors & Products

Vendor	Product	Version / Range
okta	access_gateway	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

This vulnerability involves the Okta Access Gateway management console executing user-supplied input directly through the eval() function without proper sanitization during an authenticated administrator SSH session. This allows attackers to inject and execute arbitrary code with the privileges of the management console.

Impact Analysis

An attacker with access to an authenticated administrator SSH session could exploit this to run malicious code, potentially gaining control over the Okta Access Gateway system, stealing sensitive data, or disrupting services.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security), potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Disable SSH access to the Okta Access Gateway management console until a patch is applied. Review and restrict administrator privileges to minimize exposure. Monitor logs for suspicious activity related to eval() usage or unauthorized command execution.

Hi! I’m here to help you understand CVE-2026-78550. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70