CVE-2026-78624

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*

History

22 Sep 2026, 20:19

Type	Values Removed	Values Added
CPE		cpe:2.3:a:okta:access_gateway::::::::
First Time		Okta access Gateway Okta
References	~~() https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624 -~~	() https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624 - Vendor Advisory

Information

Published : 2026-09-08 20:18

Updated : 2026-09-22 20:19

NVD link : CVE-2026-78624

Mitre link : CVE-2026-78624

CVE.ORG link : CVE-2026-78624

JSON object : View

Products Affected

okta

access_gateway

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-78624", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78624", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T14:31:34.907896Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@okta.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@okta.com", "affectedData": [{"vendor": "Okta", "product": "Okta Access Gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T20:18:37.397", "references": [{"url": "https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624", "tags": ["Vendor Advisory"], "source": "psirt@okta.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@okta.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem."}], "lastModified": "2026-09-22T20:19:15.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:okta:access_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C169A22F-2C3D-40B8-B3E7-1EEEAE47D950", "versionEndExcluding": "2026.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@okta.com"}