CVE-2026-78550: Improper Neutralization of Directives in Dynamically Evaluated Code in Okta Okta Access Gateway

The Okta Access Gateway management console passes user-supplied input directly to the eval() function without sanitization during an authenticated administrator SSH session. This improper neutralization of directives in dynamically evaluated code enables an attacker with administrator SSH access to execute arbitrary code with management console privileges. The vulnerability affects versions from 0 up to but not including 2026.9.1. The CVSS 3.1 base score is 6.6, indicating a medium severity vulnerability with network attack vector, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with authenticated administrator SSH access to the Okta Access Gateway management console can execute arbitrary code with the privileges of the management console. This can lead to full compromise of the management console, potentially impacting the confidentiality, integrity, and availability of the system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator SSH access to trusted personnel and monitor for suspicious activity.