OKTA has released security advisories for four vulnerabilities in Okta Access Gateway (OAG), disclosed on 22 October 2026. The flaws span PHP runtime components (PHP2Shell) and the Admin Console, with the most severe being a command-execution bug rated CVSSv4 9.1. Patches are available in OAG versions 2026.10.2 and 2026.44.0, and organisations are urged to update promptly. The four CVEs cited are CVE-2026-109618, CVE-2026-109619, CVE-2026-115547 and CVE-2026-115546.
Of these, CVE-2026-109618 and CVE-2026-109619 describe remote code execution (RCE) via PHP runtime and global state handling, while CVE-2026-115547 permits command execution via Admin Console input, and CVE-2026-115546 concerns authentication source verification during sign-on.
Details on impact and mitigation indicate that Okta Access Gateway’s Admin Console could be exposed to unauthorised or misused access under certain conditions. CVE-2026-115547 requires administrator privileges to exploit, but exploitability remains a critical risk given the potential for system command execution. CVE-2026-115546 involves an authentication source bypass that could allow a session to grant access to the Admin Console.
The PHP2Shell flaws are tied to bundled PHP 8.3, though Okta notes that default OAG configurations mitigate known exploits; nonetheless, affected versions include OAG prior to 2026.10.2, and PHP 8.3.x prior to 8.3.36. The advisory notes no confirmed exploitation to date, though exploitation activity has been observed broadly in PHP2Shell elsewhere. Administrations should apply 2026.10.2 or 2026.44.0 and review Admin Console access for abnormal logins.