PatchTheCVEaccess gateway vulnerabilities and fixes
Recent CVEs affecting access gateway, with upgrade or downgrade steps. 11 tracked.
Also searched as: accessgateway.
access gateway has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-09-08. Highest priority: CVE-2026-78623 (score 37/100).
- CVE-2026-78545 MEDIUM 6.6 UPGRADE The Okta Access Gateway does not sanitize the application label field before including it in the generated ngi
- CVE-2026-78550 MEDIUM 6.6 UPGRADE The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an
- CVE-2026-78579 MEDIUM 6.8 UPGRADE The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP
- CVE-2026-78560 MEDIUM 4.8 UPGRADE The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity fro
- CVE-2026-78552 MEDIUM 6.0 UPGRADE The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configura
- CVE-2026-78620 MEDIUM 5.9 UPGRADE The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payload
- CVE-2026-78623 HIGH 7.7 UPGRADE The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database querie
- CVE-2026-78624 MEDIUM 4.9 UPGRADE The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup
- CVE-2026-78625 MEDIUM 6.7 UPGRADE The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP config
- CVE-2026-78626 HIGH 8.1 UPGRADE The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Pro
- CVE-2026-78630 MEDIUM 6.7 UPGRADE The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privile
FAQ
How do I fix access gateway vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is access gateway being exploited right now?
None of the tracked access gateway CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which access gateway CVE should I patch first?
CVE-2026-78623 currently ranks highest (37/100): The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database querie.