medium4.9

CVE-2026-78624

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload.

Impact

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem.

Affected products

Vendor	Product	Affected versions
Okta	Access Gateway	before 2026.9.1

Weakness classification

CWE-22

References

NVD record
CVE.org record
https://trust.okta.com/security-advisories/improper-path-validation-in-okta-access-gateway-backup-and-restore-functionality-cve-2026-78624