CVE-2026-78550 MEDIUM

CVE-2026-78550: Improper Input Handling in Okta Access Gateway Management Console Exception Handler

Vendor Okta

Product Okta Access Gateway

Weakness CWE-95 · Eval injection

Published September 8, 2026

Last update September 10, 2026

View on NVD All CVEs

CVSS base score

6.6/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

Key dates

02Disclosure timeline

September 8, 2026 CVE published

September 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-78550 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/95.html AskarLabs — CWE-95 write-up Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Related vulnerabilities

04Related CVE

CVE-2026-4001 Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula CVE-2026-45293 WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability CVE-2025-8420 Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution CVE-2024-10633 Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated Arbitrary Shortcode Execution via content CVE-2024-3562 Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field