CVE-2026-78550 is a medium severity (CVSS 6.6) code injection flaw in the Okta Access Gateway management console. Input from an authenticated administrator SSH session is passed to eval() without sanitizing. Okta says appliance versions before 2026.9.1 are affected and that upgrading to 2026.9.1 or later resolves it.
What's affected
- Okta Access Gateway appliance versions before 2026.9.1 are affected, per Okta.
- Fixed in appliance version 2026.9.1; Okta recommends 2026.9.1 or greater.
- Preconditions from Okta: the SSH management interface is reachable from the local network, and the attacker has valid credentials for the appliance management account and can open an SSH session to the console.
Record severity: CVSS 6.6 (medium), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-95, Improper Neutralization of Directives in Dynamically Evaluated Code.
How to check if you're exposed
Check the appliance version in the admin console. Then confirm where the SSH management interface is reachable from: which networks, jump hosts and VPN ranges can open a session to it. Both facts together tell you your exposure. No workaround is listed in the advisory text we fetched.
What to do now
- Read the version of every Access Gateway appliance you run.
- Upgrade to 2026.9.1 or later using the image Okta links from the advisory.
- Restrict SSH access to the management interface to a small admin network.
- Audit who holds management account credentials and rotate them if the list is unclear.
- Review SSH login records on the appliance for sessions you cannot explain.
Why it matters
Passing user input to eval() is a long known mistake, tracked as CWE-95. The function treats a string as program code, so anything an operator types in an exception handler path can become running code with the privileges of the console process.
The score is held down by the need for valid management credentials and local network reach. That makes this a post compromise or insider risk more than an internet scale one. It still deserves a patch, because management consoles are the place where a stolen password should be stopped from becoming code execution. The record does not flag this CVE as known exploited.
Quick check
Is the SSH interface exposed to the internet by default?
The advisory does not say. It lists local network reachability as a precondition, so check your own network rules.
Which version fixes it?
Okta says 2026.9.1 resolves it, and recommends 2026.9.1 or greater.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
