Okta Access Gateway (OAG) da autentifikatsiyalangan administratorga tizim buyruqlarini bajarish imkonini beruvchi jiddiy buyruq bajarish zaifligi aniqlandi. Bu zaiflik maxsus formatlangan konfiguratsiya qiymatlarini Admin Console orqali yuborish orqali yuzaga keladi. Ushbu zaiflik 2026-yil 22-oktabr sanasida e'lon qilingan maslahatda hujjatlashtirilgan.
CVE-2026-115547 sifatida kuzatilgan bu muammo 2026.10.2 versiyasidan oldin chiqarilgan OAG qurilma versiyalariga ta'sir qiladi. Maslahat bu zaiflikka CVSS v3.1 bo'yicha 9.1 ball beradi, bu uning jiddiyligini ko'rsatadi, va 2026.10.2 versiyasini tuzatishni o'z ichiga olgan reliz sifatida ta'kidlaydi.
Ushbu zaiflikdan foydalanish OAG Admin Console'ga ma'muriy kirish huquqini talab qiladi. Bu uni autentifikatsiyasiz masofadan buyruq bajarish zaifliklaridan ajratib turadi, chunki hujumchi zaif konfiguratsiya qayta ishlashni ishga tushirish uchun allaqachon zarur ma'muriy huquqlarga ega bo'lishi kerak.
Zaiflik ma'muriy interfeys orqali qayta ishlanadigan konfiguratsiya qiymatlarining yetarli darajada tekshirilmasligidan kelib chiqadi. Autentifikatsiyalangan administrator maxsus formatlangan kiritmani taqdim etishi mumkin, bu esa OAG xizmat hisobi kontekstida tizim buyruqlarini bajaradi.
Maslahat bu zaiflikni kod in'ektsiyasi kamchiligi sifatida tasniflaydi. U uni CWE-94 (Kod yaratishni noto'g'ri nazorat qilish) va CWE-20 (Kiritmani noto'g'ri tekshirish) bilan bog'laydi.
Maslahat ta'sir qilgan konfiguratsiya maydonini, misol yuklamasini yoki buyruq qanday chaqirilishini aniqlamaydi. Shuningdek, muvaffaqiyatli foydalanish root huquqlarini berishini tasdiqlamaydi; bajarish konteksti aniq OAG xizmat hisobiga bog'langan.
Bu farq potentsial oqibatlarni baholashda muhimdir. Hujumchi bajarishi mumkin bo'lgan buyruqlar, foydalanishi mumkin bo'lgan resurslar va keyingi buzilish imkoniyatlari ushbu hisobga berilgan ruxsatlar va qurilmaning umumiy konfiguratsiyasiga bog'liq.
Berilgan CVSS vektori CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Metrikalar tarmoq orqali foydalanish, past hujum murakkabligi, yuqori huquqlar talab qilinishi va qo'shimcha foydalanuvchi o'zaro ta'siri yo'qligini ko'rsatadi.
Vektor shuningdek o'zgargan doirani va CVSS v3.1 tizimi bo'yicha maxfiylik, yaxlitlik va mavjudlikka sezilarli potentsial ta'sirni aks ettiradi.
Ma'muriy kirish talab qilinishi kim foydalanishni boshlashi mumkinligini cheklasa-da, bu zaiflikning jiddiyligini kamaytirmaydi, chunki u ilova boshqaruv interfeysi orqali operatsion tizim buyruqlarini bajarish imkonini beradi.
Maslahat hech qanday ma'lum faol foydalanish haqida xabar bermaydi, aniq tahdid aktorini aniqlamaydi yoki ommaviy foydalanish mumkin bo'lgan ekspluatatsiya kodiga havola qilmaydi. Bunday tafsilotlar faqat jiddiylik reytingiga asoslanib taxmin qilinmasligi, balki tasdiqlanmagan holda qolishi kerak.
Tavsiya etilgan tuzatish — barcha ta'sir qilgan Okta Access Gateway qurilmalarini 2026.10.2 yoki undan keyingi versiyaga yangilash. Maslahatda aytilishicha, bu relizdan oldingi versiyalar zaif bo'lib qoladi.
Xavfsizlik jamoalari o'rnatilgan qurilma versiyalarini tekshirishi va yangilashni ustuvor qilishi kerak. Qo'shimcha himoya choralari ma'muriy kirishni ko'rib chiqish va kutilmagan konfiguratsiya o'zgarishlarini tekshirishni o'z ichiga oladi. Biroq, bu choralar tuzatilgan relizni o'rnatishni almashtirmaydi.
Asosiy xavotir — imtiyozli konsol kirishidan xizmat hisobi ostida buyruq bajarishga o'tishdir. Tuzatish harakatlari zaif qayta ishlash yo'lini tuzatishga qaratilishi kerak, ma'muriy foydalanuvchilar tashkilot xavfsizlik tizimi doirasida tabiiy ravishda ishonchli deb taxmin qilinmasligi kerak.
A critical command execution vulnerability has been identified in Okta Access Gateway (OAG), which could allow an authenticated administrator to execute system commands by submitting specially formatted configuration values through the appliance’s Admin Console. This vulnerability isdocumented in an advisory dated October 22, 2026.
Tracked as CVE-2026-115547, the issue affects versions of the OAG appliance released before 2026.10.2. The advisory assigns this vulnerability a CVSS v3.1 score of 9.1, indicating its severity, and highlights version 2026.10.2 as the release that includes the necessary fix.
Exploiting this vulnerability requires administrative access to the OAG Admin Console. This requirement distinguishes it from unauthenticated remote command execution vulnerabilities, as an attacker must already possess the necessary administrative privileges to trigger the vulnerable configuration processing.
The weakness stems from insufficient validation of configuration values processed through the administrative interface. An authenticated administrator can provide specially formatted input that executes system commands in the context of the OAG service account.
The advisory classifies this vulnerability as a code injection flaw. It associates it with CWE-94 (Improper Control of Code Generation) and CWE-20 (Improper Input Validation).
The advisory does not specify the affected configuration field, provide an example payload, or describe how the command is invoked. Additionally, it does not confirm whether successful exploitation grants root privileges; the execution context is specifically tied to the OAG service account.
This distinction is important when assessing potential consequences. The commands an attacker can run, the resources they can exploit, and opportunities for further compromise depend on the permissions assigned to that account and the appliance’s overall configuration.
The provided CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The metrics indicate network-based exploitation with low attack complexity, high privileges required, and no additional user interaction.
The vector also reflects a changed scope and significant potential impacts on confidentiality, integrity, and availability, according to the CVSS v3.1 framework.
While the need for administrative access limits who can initiate exploitation, it does not reduce the vulnerability’s seriousness, as it allows execution of operating-system commands through an application management interface.
The advisory does not report any known active exploitation, identify a specific threat actor, or reference publicly available exploit code. Such details should remain unconfirmed rather than assumed based solely on the critical severity rating.
The recommended remediation is to upgrade all affected Okta Access Gateway appliances to version 2026.10.2 or later. Versions before this release remain vulnerable, as the advisory states.
Security teams should verify the deployed appliance versions and prioritize the upgrade. Additional defensive measures include reviewing administrative access and investigating unexpected configuration changes. However, these do not replace installing the fixed release.
The primary concern is the transition from privileged console access to command execution under the service account. Remediation efforts should focus on fixing the vulnerable processing path rather than assuming administrative users are inherently trusted within the organization’s security framework.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.