CVE-2026-78620

EPSS 0.25%
Veröffentlicht 08.09.2026 20:18:36
Zuletzt bearbeitet 22.09.2026 20:39:20
Erkennungen
Login

Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance filesystem.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Okta ≫ Access Gateway Version < 2026.9.1

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.25%	0.165

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	4.9	1.2	3.6	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
psirt@okta.com	5.9	0.7	5.2	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-kerberos-configuration-handling-cve-2026-78620

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-78620

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-78620

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-78620

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-78620