Vendor
Okta vulnerabilities
37 advisories tracked, 0 exploited in the wild according to CISA, 22 published in 2026.
Data refreshed 12 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
CVE-2022-24295Privileged Access and Advanced Server Access
Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to comman…
Products covered
Select a product to see only its advisories.
- Agents and Access GatewayActive Directory and LDAP agents, Access Gateway and the RADIUS server agent18 tracked
- Okta Verify and Browser PluginThe authenticator app on desktop and mobile, and the browser plugin6 tracked
- Privileged Access and Advanced Server AccessServer access clients, agents and gateways6 tracked
- Okta platform and SDKsWorkforce and Customer Identity (Auth0) services, Workflows and the SDKs7 tracked
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-84685 | Okta platform and SDKs | Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management | MEDIUM 6.5 | 0.28% | – | |
| CVE-2026-85983 | Okta platform and SDKs | Local Privilege Escalation in Auth0 AD/LDAP Connector | HIGH 7.8 | 0.20% | – | |
| CVE-2026-85982 | Okta platform and SDKs | Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector | CRITICAL 9 | 0.40% | – | |
| CVE-2026-85981 | Okta platform and SDKs | Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Connector | MEDIUM 6.7 | 0.18% | – | |
| CVE-2026-78622 | Okta Verify and Browser Plugin | Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal | MEDIUM 6 | 0.13% | – | |
| CVE-2026-78631 | Agents and Access Gateway | Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging | MEDIUM 5.3 | 0.14% | – | |
| CVE-2026-78630 | Agents and Access Gateway | Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing | MEDIUM 6.7 | 0.22% | – | |
| CVE-2026-78629 | Agents and Access Gateway | Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling | MEDIUM 5.6 | 0.14% | – | |
| CVE-2026-78635 | Privileged Access and Advanced Server Access | Improper Input Validation in the Okta Privileged Access SSH Client URL Handler Argument | MEDIUM 5 | 0.20% | – | |
| CVE-2026-78620 | Agents and Access Gateway | Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling | MEDIUM 5.9 | 0.34% | – | |
| CVE-2026-78579 | Agents and Access Gateway | Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation | MEDIUM 6.8 | 0.24% | – | |
| CVE-2026-78627 | Agents and Access Gateway | Improper Credential Protection in Okta Hyperdrive Integration Installer Logging | HIGH 7.3 | 0.14% | – | |
| CVE-2026-78574 | Agents and Access Gateway | Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling | HIGH 7.5 | 0.10% | – | |
| CVE-2026-78626 | Agents and Access Gateway | Improper Input Sanitization in Okta Access Gateway Protected Rules | HIGH 8.1 | 0.36% | – | |
| CVE-2026-78625 | Agents and Access Gateway | Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration | MEDIUM 6.7 | 0.23% | – | |
| CVE-2026-78624 | Agents and Access Gateway | Improper Path Validation in Okta Access Gateway Backup and Restore Functionality | MEDIUM 4.9 | 0.46% | – | |
| CVE-2026-78560 | Agents and Access Gateway | Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source | MEDIUM 4.8 | 0.20% | – | |
| CVE-2026-78552 | Agents and Access Gateway | Validation Bypass in Okta Access Gateway Custom Directives | MEDIUM 6 | 0.27% | – | |
| CVE-2026-78623 | Agents and Access Gateway | Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores | HIGH 7.7 | 0.45% | – | |
| CVE-2026-78550 | Agents and Access Gateway | Improper Input Handling in Okta Access Gateway Management Console Exception Handler | MEDIUM 6.6 | 0.38% | – | |
| CVE-2026-78545 | Agents and Access Gateway | Improper Input Sanitization in Okta Access Gateway Application Label Configuration | MEDIUM 6.6 | 0.38% | – | |
| CVE-2026-77585 | Privileged Access and Advanced Server Access | Improper Validation of SSH Target in Okta Privileged Access Client | MEDIUM 5.3 | 0.14% | – | |
| CVE-2025-67505 | Okta platform and SDKs | Race condition in the Okta Java SDK | HIGH 8.4 | 0.21% | – | |
| CVE-2025-66033 | Okta platform and SDKs | Improper Memory Cleanup in the Okta Java SDK | MEDIUM 5.3 | 0.27% | – | |
| CVE-2025-7371 | Agents and Access Gateway | Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This in Okta On-Premises Provisioning Agent | MEDIUM 6.8 | 0.31% | – | |
| CVE-2024-9875 | Privileged Access and Advanced Server Access | Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation in Okta Privileged Access Server Agent (SFTD) | HIGH 7.1 | 0.24% | – | |
| CVE-2024-9191 | Okta Verify and Browser Plugin | The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the Okta… | HIGH 7.1 | 0.24% | – | |
| CVE-2024-10327 | Okta Verify and Browser Plugin | A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notif… | HIGH 8.1 | 0.60% | – | |
| CVE-2024-7061 | Okta Verify and Browser Plugin | Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The in Okta Verify for Windows | MEDIUM 5.5 | 0.21% | – | |
| CVE-2024-0981 | Okta Verify and Browser Plugin | Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site… | HIGH 7.1 | 0.36% | – | |
| CVE-2024-0980 | Okta Verify and Browser Plugin | The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could b… | HIGH 7.1 | 0.46% | – | |
| CVE-2023-0392 | Agents and Access Gateway | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrar… | LOW 3.9 | 0.21% | – | |
| CVE-2023-0093 | Privileged Access and Advanced Server Access | Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due t… | HIGH 8.8 | 1.1% | – | |
| CVE-2022-3145 | Okta platform and SDKs | Open redirect in Okta OIDC Middleware | MEDIUM 4.7 | 0.41% | – | |
| CVE-2022-1697 | Agents and Access Gateway | Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using… | – | 0.25% | – | |
| CVE-2022-1030 | Privileged Access and Advanced Server Access | Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable t… | – | 1.5% | – | |
| CVE-2022-24295 | Privileged Access and Advanced Server Access | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to comman… | – | 17% | – |
Sources: Okta security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.