The Okta Access Gateway Admin Console accepts specially formatted configuration values that are not properly validated. An authenticated administrator can manipulate these inputs to run arbitrary system commands under the OAG service account. This results in full compromise of the gateway appliance, allowing attackers to exfiltrate data, modify system state, or launch further attacks within the organization. The weakness corresponds to improper input validation and code injection.

Okta Access Gateway appliances are affected. No specific versions are documented in the advisory; users should verify their installation against the latest patch releases and consider the risk if running older versions.

With a CVSS score of 9.1 and no EPSS data, the vulnerability is considered high severity. Although it is not listed in the CISA KEV catalog, the lack of exploit probability data does not change the fact that a privileged administrator can execute commands. The likely attack vector requires authenticated access to the admin console, making it critical for organizations to assume that any administrative privilege could be abused if the console is compromised.