CVE-2026-78626: fallo de gravedad alta en Okta Access Gateway
Improper Input Sanitization in Okta Access Gateway Protected Rules
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.4%
The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Okta · Okta Access GatewayCVEs relacionadas — Okta Access Gateway
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-115547CRITICALCommand Execution via Admin Console Input in Okta Access GatewayEPSS 0.5%CVE-2026-78624MEDIUMImproper Path Validation in Okta Access Gateway Backup and Restore FunctionalityEPSS 0.5%CVE-2026-78623HIGHImproper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode DatastoresEPSS 0.4%CVE-2026-115546HIGHAuthentication Source Verification Issue in Okta Access GatewayEPSS 0.4%CVE-2026-78552MEDIUMValidation Bypass in Okta Access Gateway Custom DirectivesEPSS 0.4%CVE-2026-78550MEDIUMImproper Input Handling in Okta Access Gateway Management Console Exception HandlerEPSS 0.4%