CVE-2026-78630 PUBLISHED

Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing

Assigner: Okta
Reserved: 24.08.2026 Published: 08.09.2026 Updated: 08.09.2026

The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS commands with root privileges.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.7

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Okta
Product	Okta Access Gateway
Versions	Default: unaffected affected from 0 to 2026.9.1 (excl.)

Solutions

Upgrade the Okta Access Gateway appliance to version 2026.9.1 or greater.

References

https://trust.okta.com/security-advisories/improper-input-neutralization-in-okta-access-gateway-snmp-configuration-processing-cve-2026-78630

Problem Types

Improper Neutralization of Special Elements used in an OS Command