Vulnerability intelligence

CVE-2026-78626

Improper Input Sanitization in Okta Access Gateway Protected Rules

Okta Okta Access Gateway CWE-863

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

CVSS Score

8.1

High

EPSS — Exploit Probability

0.4%

Riskier than 28% of all CVEs · checked 2026-10-24

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published