CVE-2026-78550

Summary

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

Affected Software

Weaknesses

• CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://trust.okta.com/security-advisories/improper-input-handling-in-okta-access-gateway-management-console-exception-handler-cve-2026-78550

• ←Previous
• Next→