Skip to content
Noroxi

Okta records

30 published records for vendor okta.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
76.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

30 records
  • CVE-2022-24295
    40Plan

    Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially craft

    HighCVSS 8.8No exploitEPSS 16%

    okta · advanced server access client for windowsFeb 21, 2022

  • CVE-2026-78623
    39Monitor

    Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

    CriticalCVSS 9.9No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2022-1030
    35Monitor

    Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a special

    HighCVSS 8.8No exploitEPSS 1%

    okta · advanced server accessMar 23, 2022

  • CVE-2023-0093
    35Monitor

    Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrow

    HighCVSS 8.8No exploitEPSS 1%

    okta · advanced server accessMar 6, 2023

  • CVE-2021-28113
    33Monitor

    A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (wi

    MediumCVSS 6.7No exploitEPSS 22%

    okta · access gatewayApr 2, 2021

  • CVE-2025-67505
    33Monitor

    Race condition in the Okta Java SDK

    HighCVSS 8.4No exploitEPSS 0%

    okta · java management sdkDec 10, 2025

  • CVE-2024-10327
    32Monitor

    A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS

    HighCVSS 8.1No exploitEPSS 0%

    okta · okta verify for iosOct 24, 2024

  • CVE-2024-9191
    31Monitor

    The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables a

    HighCVSS 7.8No exploitEPSS 0%

    okta · verifyNov 1, 2024

  • CVE-2024-7061
    31Monitor

    Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking.

    HighCVSS 7.8No exploitEPSS 0%

    okta · verifyAug 7, 2024

  • CVE-2024-0980
    28Monitor

    The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.

    HighCVSS 7.1No exploitEPSS 0%

    okta · okta verify for windowsMar 27, 2024

  • CVE-2026-78545
    28Monitor

    Improper Input Sanitization in Okta Access Gateway Application Label Configuration

    HighCVSS 7.2No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2026-78550
    28Monitor

    Improper Input Handling in Okta Access Gateway Management Console Exception Handler

    HighCVSS 7.2No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2024-9875
    28Monitor

    Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo comm

    HighCVSS 7.1No exploitEPSS 0%

    okta · okta privileged access server agent (sftd)Nov 21, 2024

  • CVE-2026-78626
    26Monitor

    Improper Input Sanitization in Okta Access Gateway Protected Rules

    MediumCVSS 6.5No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2026-78579
    26Monitor

    Improper Input Sanitization in Okta Access Gateway LDAP Datastore Filter Interpolation

    MediumCVSS 6.5No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2026-78560
    26Monitor

    Improper Authentication Validation in Okta Access Gateway Pass-Through Authentication Source

    MediumCVSS 6.5No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2026-78625
    26Monitor

    Insufficient Validation of Dashboard Application Labels in Okta Access Gateway Dashboard Site Configuration

    MediumCVSS 6.7No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2026-78630
    26Monitor

    Improper Input Neutralization in Okta Access Gateway SNMP Configuration Processing

    MediumCVSS 6.7No exploitEPSS 0%

    okta · access gatewaySep 8, 2026

  • CVE-2023-0392
    26Monitor

    The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.

    MediumCVSS 6.7No exploitEPSS 0%

    okta · ldap agentNov 8, 2023

  • CVE-2026-78574
    25Monitor

    Improper Assembly Resolution in Okta Hyperdrive Integration Plugin Registry Handling

    MediumCVSS 6.3No exploitEPSS 0%

    okta · hyperdriveSep 8, 2026

  • CVE-2026-78629
    22Monitor

    Improper Authentication Verification in the Okta Hyperdrive Agent MFA Response Handling

    MediumCVSS 5.5No exploitEPSS 0%

    okta · hyperdriveSep 8, 2026

  • CVE-2026-78627
    22Monitor

    Improper Credential Protection in Okta Hyperdrive Integration Installer Logging

    MediumCVSS 5.5No exploitEPSS 0%

    okta · hyperdriveSep 8, 2026

  • CVE-2026-78631
    22Monitor

    Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging

    MediumCVSS 5.5No exploitEPSS 0%

    okta · hyperdriveSep 8, 2026

  • CVE-2021-45094
    21Monitor

    Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.

    MediumCVSS 5.4No exploitEPSS 0%

    okta · imprivata privileged access managementJul 20, 2023

  • CVE-2025-66033
    21Monitor

    Improper Memory Cleanup in the Okta Java SDK

    MediumCVSS 5.3No exploitEPSS 0%

    okta · java management sdkDec 10, 2025