Critical Code Injection Flaw in Okta Access Gateway Allows Authenticated Command Execution
Okta has published an advisory detailing CVE-2026-115547, a critical code injection vulnerability affecting the administrative console of Okta Access Gateway. The flaw allows an authenticated administrator to execute arbitrary commands on the appliance with the permissions of the gateway service account.
The vulnerability carries a CVSS 3.1 base score of 9.1 and is classified under CWE-94 (Improper Control of Generation of Code) and CWE-20 (Improper Input Validation). It resides in the console’s handling of configuration values submitted in a specific format, bypassing expected input restrictions.
Versions of the Access Gateway appliance prior to 2026.10.2 are affected. Okta states that the issue is resolved in 2026.10.2 and later releases. No mitigation or workaround is available, making immediate patching the only recommended action.
Exploitation requires administrative access to the Access Gateway console. The advisory notes high privileges as a prerequisite and changed scope, indicating potential impact on components beyond the vulnerable appliance itself. No unauthenticated attack vector or authentication bypass is described.
On the same day, Okta released two additional advisories for the product. One addresses authentication source verification (CVE-2026-115546). The second covers PHP execution flaws tracked as CVE-2026-109618 and CVE-2026-109619, the same issues previously confirmed by Palo Alto Networks in PAN-OS.
Okta has not reported any active exploitation, named threat actors, or provided proof-of-concept code. No external researcher is credited for the discovery. Operators are advised to verify installed versions and review administrative console access permissions.
Related articles
GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution
GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.
Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy
A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.
Microsoft Issues Out-of-Band .NET Security Updates Fixing Brotli Buffer Overflow and Other Flaws
Microsoft has released out-of-band security updates for .NET 10, .NET 9, and .NET 8 to address multiple vulnerabilities. The patches cover two newly identified issues and complete remediation for two additional flaws that received incomplete fixes during the October 13 monthly update cycle. One critical vulnerability, CVE-2026-111497, affects the Brotli compression library and can lead to information disclosure, denial of service, or privilege escalation when processing crafted compressed data. A second issue, CVE-2026-114148, enables local privilege escalation in Linux distribution packages for ASP.NET Core due to improper ownership handling. Microsoft also reissued fixes for remote code execution vulnerabilities CVE-2026-70197 and CVE-2026-102870. Organizations are advised to apply the updates immediately, including rebuilding and redistributing applications in container or embedded environments.
Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate
Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.