Okta Patches Access Gateway Flaws, Including PHP2Shell and Admin Console Bugs
Do Son 
TL;DR
On October 22, 2026, Okta disclosed four Okta Access Gateway vulnerabilities in three advisories. They include the PHP2Shell flaws in its PHP runtime and a CVSS 9.1 command execution bug in the Admin Console. Fixes ship in OAG 2026.10.2 and 2026.44.0.
- Product: Okta Access Gateway, PHP Group PHP
- Vulnerabilities: 4 flaws (CVE-2026-115547, CVE-2026-115546, CVE-2026-109618, CVE-2026-109619)
- Highest severity: 9.2 (Critical · CVSSv4)
- Worst impact: RCE via OOM corruption
- Status: No confirmed exploitation yet; patches available
- Exploit Intel (PatchThis): 1 of 4 confirmed
- Action: Update to 2026.10.2, 8.2.35, 8.3.36, 8.4.27 (+1) now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status | PoC |
|---|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | RCE via OOM corruption | 8.2.35, 8.3.36, 8.4.27 (+1) | Not exploited | Available (Nuclei) |
| CVE-2026-109619 | 9.2 | RCE via stale global state | 8.2.35, 8.3.36, 8.4.27 (+1) | Not exploited | — |
| CVE-2026-115547 | 9.1 | CWE-20 | 2026.10.2 | Not exploited | — |
| CVE-2026-115546 | 8.1 | CWE-287 | 2026.10.2 | Not exploited | — |
Why It Matters
Okta Access Gateway (OAG) brings Okta sign-on to on-premises apps. Admin access to the gateway can therefore expose the apps behind it. Moreover, one flaw lets an ordinary signed-in user reach the Admin Console.
How the Attacks Work
Admin Console command execution
The Okta advisory for CVE-2026-115547 describes an input validation flaw. An authenticated administrator can “execute system commands within the context of the OAG service account.” The flaw carries a CVSS score of 9.1, though it requires admin rights.
Authentication source bypass
CVE-2026-115546 (CVSS 8.1) stems from missing checks. According to the Okta authentication source verification advisory, OAG “does not validate the selected authentication source during sign-on.” A user with a session can change that value, which “may generate a SAML assertion granting access to the Admin Console.” Notably, Okta lists just one precondition: a valid session on any authentication source configured on the gateway.
PHP2Shell
OAG also bundles PHP 8.3, which carries the PHP2Shell remote code execution flaws. However, Okta says OAG’s “default configuration mitigates known exploitation.”
Exploitation status
PHP2Shell is under broad attack elsewhere, according to Amazon. Okta does not report attacks on OAG for any of these Okta Access Gateway vulnerabilities.
Affected Versions
- CVE-2026-115546 and CVE-2026-115547: OAG before 2026.10.2
- PHP2Shell: OAG before 2026.44.0, running PHP 8.3.x before 8.3.36
Patch and Mitigation Steps
Upgrade OAG to 2026.44.0, which includes PHP 8.3.36 and the 2026.10.2 fixes. Meanwhile, review Admin Console access for unexpected logins.
The Okta PHP2Shell advisory for Access Gateway has more details. Teams should patch these Okta Access Gateway vulnerabilities promptly.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
