CVE-2026-78620

EUVD-2026-74178
The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
OktaCNA
5.9 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
oktaaccess_gateway
𝑥
< 2026.9.1
CNA
Common Weakness Enumeration
References
https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620