CVE-2026-78630: Improper Neutralization of Special Elements used in an OS Command in Okta Okta Access Gateway

The Okta Access Gateway fails to properly sanitize shell metacharacters in SNMP configuration values before these values are incorporated into privileged OS command scripts. An authenticated local user with access to the management interface can supply crafted SNMP configuration values that lead to arbitrary OS command execution with root privileges. This vulnerability affects versions >=0 and <2026.9.1 of Okta Access Gateway. The CVSS 3.1 base score is 6.7, reflecting a medium severity level with high impact on confidentiality, integrity, and availability, but requiring local privileged access.

Successful exploitation allows an authenticated local user with management interface access to execute arbitrary OS commands as root, potentially compromising the entire system's confidentiality, integrity, and availability. The attack requires local access with high privileges, limiting remote exploitation risk.

A fix is available in Okta Access Gateway version 2026.9.1. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided in the vendor advisory; applying the official patch is the recommended action.