CVE-2026-78626

High8.1Published on September 8, 2026

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

CVSS score8.1 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness type (CWE)CWE-863

Vendorsokta

Affected products

Vendors	Product	Versions
okta	access gateway	< 2026.9.1

Vulnerabilities

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

Sep 21, 202617:436 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels