CVE-2026-78550

The Okta Access Gateway management console passes user-supplied input to eval() without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console.

  • Published Sep 8, 2026
  • CVSS 7.2 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-78550 at the National Vulnerability Database