What’s Vulnerable › Vulnerabilities
CVE-2026-78624: Improper Path Validation in Okta Access Gateway Backup and Restore Functionality
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-08 · updated 2026-09-22
- Weakness: CWE-22
Description
The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.
Affected products
- Okta Access Gateway: before 2026.9.1 — fixed in 2026.9.1
How to fix
Upgrade to a fixed version: Okta Access Gateway 2026.9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-78624 or the next vulnerability affects your stack