PatchTheCVEokta vulnerabilities
Recent CVEs affecting okta products. 15 tracked.
okta has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-09-08. Highest priority: CVE-2026-78623 (score 37/100).
- CVE-2026-78545 MEDIUM 6.6 UPGRADE The Okta Access Gateway does not sanitize the application label field before including it in the generated ngi
- CVE-2026-78550 MEDIUM 6.6 UPGRADE The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an
- CVE-2026-78579 MEDIUM 6.8 UPGRADE The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP
- CVE-2026-78574 HIGH 7.5 UPGRADE The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current u
- CVE-2026-78560 MEDIUM 4.8 UPGRADE The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity fro
- CVE-2026-78552 MEDIUM 6.0 UPGRADE The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configura
- CVE-2026-78620 MEDIUM 5.9 UPGRADE The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payload
- CVE-2026-78623 HIGH 7.7 UPGRADE The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database querie
- CVE-2026-78624 MEDIUM 4.9 UPGRADE The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup
- CVE-2026-78625 MEDIUM 6.7 UPGRADE The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP config
- CVE-2026-78626 HIGH 8.1 UPGRADE The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Pro
- CVE-2026-78627 HIGH 7.3 UPGRADE The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property
- CVE-2026-78629 MEDIUM 5.6 UPGRADE The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organizat
- CVE-2026-78630 MEDIUM 6.7 UPGRADE The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privile
- CVE-2026-78631 MEDIUM 5.3 UPGRADE The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the defa
FAQ
How do I fix okta vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is okta being exploited right now?
None of the tracked okta CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which okta CVE should I patch first?
CVE-2026-78623 currently ranks highest (37/100): The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database querie.