# Okta CVEs > Okta: 36 CVEs mapped to its software or packages (0 in CISA KEV), newest first, with CVSS and EPSS. Canonical: https://rewindex.com/company/okta/cves Last updated: 2026-10-23T03:06:45Z 36 CVEs map to Okta (0 in CISA KEV), newest first. Page 1. Query: `?sev=critical|high|medium|low&kev=yes|no&min_cvss=0..10&q=&page=N`. Company profile: [Okta](https://rewindex.com/company/okta.md) Scope: CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. A mapped CVE is not a statement that Okta’s hosted service was exposed. | Published (UTC) | CVE | Title | CVSS | KEV | | --- | --- | --- | --- | --- | | 2026-10-23 | [CVE-2026-115547](https://rewindex.com/cve/CVE-2026-115547.md) | Command Execution via Admin Console Input in Okta Access Gateway | 9.1 critical | | | 2026-10-23 | [CVE-2026-115546](https://rewindex.com/cve/CVE-2026-115546.md) | Authentication Source Verification Issue in Okta Access Gateway | 8.1 high | | | 2026-10-13 | [CVE-2026-85473](https://rewindex.com/cve/CVE-2026-85473.md) | Out-of-Range Timestamp Claim Handling in auth0/java-jwt | 5.3 medium | | | 2026-10-13 | [CVE-2026-78633](https://rewindex.com/cve/CVE-2026-78633.md) | Denial of Service in Okta RADIUS Agent Packet Parser | 6.5 medium | | | 2026-10-13 | [CVE-2026-78632](https://rewindex.com/cve/CVE-2026-78632.md) | Insecure Default File Permissions in Okta RADIUS Agent Windows Installer | 5.3 medium | | | 2026-10-13 | [CVE-2026-107371](https://rewindex.com/cve/CVE-2026-107371.md) | Missing Verification of auth\_time Claim in auth0.js | 5.4 medium | | | 2026-10-13 | [CVE-2026-107370](https://rewindex.com/cve/CVE-2026-107370.md) | Improper Request Handling for Active Directory Logins in auth0-lock | 5.3 medium | | | 2026-10-13 | [CVE-2026-107369](https://rewindex.com/cve/CVE-2026-107369.md) | Improper Validation of Post-Login Redirect URL in nextjs-auth0 | 6.1 medium | | | 2026-10-13 | [CVE-2026-78628](https://rewindex.com/cve/CVE-2026-78628.md) | Improper Input Validation in the Okta Credential Provider for Windows | 6.0 medium | | | 2026-09-08 | [CVE-2026-84685](https://rewindex.com/cve/CVE-2026-84685.md) | Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management | 6.5 medium | | | 2026-09-08 | [CVE-2026-85983](https://rewindex.com/cve/CVE-2026-85983.md) | Local Privilege Escalation in Auth0 AD/LDAP Connector | 7.8 high | | | 2026-09-08 | [CVE-2026-85982](https://rewindex.com/cve/CVE-2026-85982.md) | Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector | 9.0 critical | | | 2026-09-08 | [CVE-2026-85981](https://rewindex.com/cve/CVE-2026-85981.md) | Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector | 6.7 medium | | | 2026-09-08 | [CVE-2026-78622](https://rewindex.com/cve/CVE-2026-78622.md) | Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal | 6.0 medium | | | 2026-09-08 | [CVE-2026-78631](https://rewindex.com/cve/CVE-2026-78631.md) | Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging | 5.3 medium | | | 2026-09-08 | [CVE-2026-78630](https://rewindex.com/cve/CVE-2026-78630.md) | Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing | 6.7 medium | | | 2026-09-08 | [CVE-2026-78629](https://rewindex.com/cve/CVE-2026-78629.md) | Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling | 5.6 medium | | | 2026-09-08 | [CVE-2026-78635](https://rewindex.com/cve/CVE-2026-78635.md) | Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument | 5.0 medium | | | 2026-09-08 | [CVE-2026-78620](https://rewindex.com/cve/CVE-2026-78620.md) | Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling | 5.9 medium | | | 2026-09-08 | [CVE-2026-78579](https://rewindex.com/cve/CVE-2026-78579.md) | Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation | 6.8 medium | | | 2026-09-08 | [CVE-2026-78627](https://rewindex.com/cve/CVE-2026-78627.md) | Improper Credential Protection in Okta Hyperdrive Integration Installer Logging | 7.3 high | | | 2026-09-08 | [CVE-2026-78574](https://rewindex.com/cve/CVE-2026-78574.md) | Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling | 7.5 high | | | 2026-09-08 | [CVE-2026-78626](https://rewindex.com/cve/CVE-2026-78626.md) | Improper Input Sanitization in Okta Access Gateway Protected Rules | 8.1 high | | | 2026-09-08 | [CVE-2026-78625](https://rewindex.com/cve/CVE-2026-78625.md) | Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration | 6.7 medium | | | 2026-09-08 | [CVE-2026-78624](https://rewindex.com/cve/CVE-2026-78624.md) | Improper Path Validation in Okta Access Gateway Backup and Restore Functionality | 4.9 medium | | | 2026-09-08 | [CVE-2026-78560](https://rewindex.com/cve/CVE-2026-78560.md) | Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source | 4.8 medium | | | 2026-09-08 | [CVE-2026-78552](https://rewindex.com/cve/CVE-2026-78552.md) | Validation Bypass in Okta Access Gateway Custom Directives | 6.0 medium | | | 2026-09-08 | [CVE-2026-78623](https://rewindex.com/cve/CVE-2026-78623.md) | Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores | 7.7 high | | | 2026-09-08 | [CVE-2026-78550](https://rewindex.com/cve/CVE-2026-78550.md) | Improper Input Handling in Okta Access Gateway Management Console Exception Handler | 6.6 medium | | | 2026-09-08 | [CVE-2026-78545](https://rewindex.com/cve/CVE-2026-78545.md) | Improper Input Sanitization in Okta Access Gateway Application Label Configuration | 6.6 medium | | | 2026-08-25 | [CVE-2026-77585](https://rewindex.com/cve/CVE-2026-77585.md) | Improper Validation of SSH Target in Okta Privileged Access Client | 5.3 medium | | | 2025-12-10 | [CVE-2025-67505](https://rewindex.com/cve/CVE-2025-67505.md) | Race condition in the Okta Java SDK | 8.4 high | | | 2025-12-10 | [CVE-2025-66033](https://rewindex.com/cve/CVE-2025-66033.md) | Improper Memory Cleanup in the Okta Java SDK | 5.3 medium | | | 2025-07-22 | [CVE-2025-7371](https://rewindex.com/cve/CVE-2025-7371.md) | | 6.8 medium | | | 2024-11-20 | [CVE-2024-9875](https://rewindex.com/cve/CVE-2024-9875.md) | | 7.1 high | | | 2024-11-01 | [CVE-2024-9191](https://rewindex.com/cve/CVE-2024-9191.md) | | 7.1 high | | --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ ## Charts ### Chart data: CVEs per week, last 52 weeks (Okta) Weeks start Monday, UTC. Bars: CVEs by published date (KEV date added if unpublished), by CVSS severity; kev_added: entries added to CISA KEV that week. Same filters as the list. The current week is partial. | Week of (UTC) | Critical | High | Medium | Low | Not scored | Added to KEV | | --- | --- | --- | --- | --- | --- | --- | | 2025-11-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-11-24 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-08 | 0 | 1 | 1 | 0 | 0 | 0 | | 2025-12-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2025-12-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-12 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-19 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-01-26 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-02-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-02 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-09 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-16 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-23 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-03-30 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-04-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-04 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-11 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-18 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-05-25 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-01 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-08 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-15 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-22 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-06-29 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-06 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-13 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-20 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-07-27 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-03 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-10 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-17 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-08-24 | 0 | 0 | 1 | 0 | 0 | 0 | | 2026-08-31 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-07 | 1 | 5 | 15 | 0 | 0 | 0 | | 2026-09-14 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-21 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-09-28 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-05 | 0 | 0 | 0 | 0 | 0 | 0 | | 2026-10-12 | 0 | 0 | 7 | 0 | 0 | 0 | | 2026-10-19 | 1 | 1 | 0 | 0 | 0 | 0 | | 2026-10-26 | 0 | 0 | 0 | 0 | 0 | 0 | --- Canonical: https://rewindex.com/company/okta/cves · Markdown: https://rewindex.com/company/okta/cves.md · JSON: https://rewindex.com/api/v1/companies/okta/cves · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:26.643Z