On October 23, 2026, the National Vulnerability Database published Okta’s CVE-2026-115547 with a 9.1 critical score driven by impact. CISA’s assessment on that record rates exploitation as none.
The Brief
- CVE-2026-115547 scores 9.1 critical, according to NVD data supplied by Okta. Its impact subscore there is 6.0, while its exploitability subscore is only 2.3.
- CISA’s assessment on the record lists exploitation as none. It also lists the flaw as not automatable, with total technical impact, per CISA.
- The record’s status is Received. The database has not analyzed it yet, per NVD, so Okta’s score is the only one listed.
- Customers should upgrade to version 2026.10.2 or greater, per Okta. The advisory lists no workaround.
The 9.1 comes from impact, not ease of attack
The National Vulnerability Database record for CVE-2026-115547 shows a base score of 9.1. That score has an impact subscore of 6.0 and an exploitability subscore of 2.3. The record lists psirt@okta.com as the source of that score, which is Okta’s own security contact. Its vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Impact outweighs exploitability by roughly 2.6 to 1. The “PR:H” element in the vector means an attacker needs high privileges first, and that holds exploitability down. The “S:C” and three “H” impact letters lift the total anyway.
Okta’s advisory carries the same CVSS v3 score of 9.1 and classes the bug as Code Injection. The description says the Admin Console allows the processing of specially formatted configuration values.
Okta fixes four Okta Access Gateway vulnerabilities, including PHP2Shell and CVE-2026-115547 command execution. Upgrade OAG to 2026.44.0. #Okta #OktaAccessGateway #PHP2Shell #CVE2026115547 #CVE2026115546 #IAM #SAML #CyberSecurity https://t.co/aDOngKk77x
— Daily CyberSecurity (@Daily_CyberSec) October 23, 2026
CISA’s triage read shows what the score hides
CISA’s coordinator role added a Stakeholder-Specific Vulnerability Categorization (SSVC) assessment to the record, timestamped 10:46 UTC on October 23, 2026. It lists exploitation as none, automatable as no, and technical impact as total. Those three fields give defenders a triage read that the 9.1 headline does not carry.
Read together, the fields describe a flaw with no exploitation recorded by CISA at that timestamp and no rating as automatable. Total technical impact still applies if an attacker gets in. That places the flaw in an urgent-but-not-emergency lane for patch queues. The exploitation field is the one most likely to change, so it merits a recheck before the queue is set.
Okta’s advisory leaves out the detail defenders want
Okta’s advisory does not name the vulnerable field or an example payload. It says an authenticated administrator can leverage this to execute system commands within the context of the OAG service account. It tells customers to upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.
The advisory sets one precondition: an authenticated user has administrative access to the Okta Access Gateway Admin Console. It lists upgrading as the only remediation and offers no workaround. Customers using appliance versions prior to 2026.10.2 are affected, so the installed version is the one reliable test of exposure.
What’s Next?
A stolen console login now carries more weight on any appliance below the fixed release. Auditing who holds Admin Console access helps reduce risk until the upgrade lands. It does not replace the upgrade.
The record’s status of Received means the database has not added its own analysis. Until it does, the 9.1 is Okta’s number alone. The 2026.10.2 build is the checkpoint the advisory names.
