# cve.now: Okta

The newest entries naming Okta as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115547](https://cve.now/CVE-2026-115547.md): Command Execution via Admin Console Input in Okta Access Gateway (CVSS 9.1)
- [CVE-2026-115546](https://cve.now/CVE-2026-115546.md): Authentication Source Verification Issue in Okta Access Gateway (CVSS 8.1)
- [CVE-2026-78633](https://cve.now/CVE-2026-78633.md): Denial of Service in Okta RADIUS Agent Packet Parser (CVSS 6.5)
- [CVE-2026-78632](https://cve.now/CVE-2026-78632.md): Insecure Default File Permissions in Okta RADIUS Agent Windows Installer (CVSS 5.3)
- [CVE-2026-78628](https://cve.now/CVE-2026-78628.md): Improper Input Validation in the Okta Credential Provider for Windows (CVSS 6.0)
- [CVE-2026-78622](https://cve.now/CVE-2026-78622.md): Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal (CVSS 6.0)
- [CVE-2026-78631](https://cve.now/CVE-2026-78631.md): Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging (CVSS 5.3)
- [CVE-2026-78630](https://cve.now/CVE-2026-78630.md): Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing (CVSS 6.7)
- [CVE-2026-78629](https://cve.now/CVE-2026-78629.md): Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling (CVSS 5.6)
- [CVE-2026-78635](https://cve.now/CVE-2026-78635.md): Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument (CVSS 5.0)
- [CVE-2026-78620](https://cve.now/CVE-2026-78620.md): Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling (CVSS 5.9)
- [CVE-2026-78579](https://cve.now/CVE-2026-78579.md): Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation (CVSS 6.8)
- [CVE-2026-78627](https://cve.now/CVE-2026-78627.md): Improper Credential Protection in Okta Hyperdrive Integration Installer Logging (CVSS 7.3)
- [CVE-2026-78574](https://cve.now/CVE-2026-78574.md): Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling (CVSS 7.5)
- [CVE-2026-78626](https://cve.now/CVE-2026-78626.md): Improper Input Sanitization in Okta Access Gateway Protected Rules (CVSS 8.1)
- [CVE-2026-78625](https://cve.now/CVE-2026-78625.md): Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration (CVSS 6.7)
- [CVE-2026-78624](https://cve.now/CVE-2026-78624.md): Improper Path Validation in Okta Access Gateway Backup and Restore Functionality (CVSS 4.9)
- [CVE-2026-78560](https://cve.now/CVE-2026-78560.md): Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source (CVSS 4.8)
- [CVE-2026-78552](https://cve.now/CVE-2026-78552.md): Validation Bypass in Okta Access Gateway Custom Directives (CVSS 6.0)
- [CVE-2026-78623](https://cve.now/CVE-2026-78623.md): Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores (CVSS 7.7)
- [CVE-2026-78550](https://cve.now/CVE-2026-78550.md): Improper Input Handling in Okta Access Gateway Management Console Exception Handler (CVSS 6.6)
- [CVE-2026-78545](https://cve.now/CVE-2026-78545.md): Improper Input Sanitization in Okta Access Gateway Application Label Configuration (CVSS 6.6)
- [CVE-2026-77585](https://cve.now/CVE-2026-77585.md): Improper Validation of SSH Target in Okta Privileged Access Client (CVSS 5.3)
- [CVE-2025-67505](https://cve.now/CVE-2025-67505.md): Race condition in the Okta Java SDK (CVSS 8.4)
- [CVE-2025-66033](https://cve.now/CVE-2025-66033.md): Improper Memory Cleanup in the Okta Java SDK (CVSS 5.3)
- [CVE-2025-7371](https://cve.now/CVE-2025-7371.md): Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. (CVSS 6.8)
- [CVE-2024-9875](https://cve.now/CVE-2024-9875.md): Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo comm (CVSS 7.1)
- [CVE-2024-9191](https://cve.now/CVE-2024-9191.md): The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables a (CVSS 7.1)
- [CVE-2024-10327](https://cve.now/CVE-2024-10327.md): A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS (CVSS 8.1)
- [CVE-2024-7061](https://cve.now/CVE-2024-7061.md): Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. (CVSS 5.5)
- [CVE-2024-0981](https://cve.now/CVE-2024-0981.md): Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. (CVSS 7.1)
- [CVE-2024-0980](https://cve.now/CVE-2024-0980.md): The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. (CVSS 7.1)
- [CVE-2023-0392](https://cve.now/CVE-2023-0392.md): The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. (CVSS 3.9)
- [CVE-2023-0093](https://cve.now/CVE-2023-0093.md): Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrow (CVSS 8.8)
- [CVE-2022-3145](https://cve.now/CVE-2022-3145.md): An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary (CVSS 4.7)
- [CVE-2022-1697](https://cve.now/CVE-2022-1697.md): Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. (no CVSS)
- [CVE-2022-1030](https://cve.now/CVE-2022-1030.md): Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a special (no CVSS)
- [CVE-2022-24295](https://cve.now/CVE-2022-24295.md): Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially craft (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/okta
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.