Okta Vulnerabilities: 72 CVEs Since 2021, 4 in CISA KEV (None in Okta’s Own Code), and 4 Disclosed Incidents

As of November 12, 2026, Okta vulnerabilities total 72 CVEs since 2021: 70 on Okta’s own advisory page and 2 more Okta assigned in NVD. 41 arrived in 2026, more than the previous five years combined. CISA’s exploited list holds 4, all Log4j or PHP flaws in bundled components, not Okta’s code. Separately, Okta has disclosed 4 security incidents since 2022.

A CVE is a flaw in software Okta ships, fixed by upgrading. An incident is an attacker inside Okta’s or a supplier’s systems. Most pages ranking for this query mix the two, and some add phishing campaigns aimed at Okta customers, which are neither. This page keeps them in separate ledgers. Every row links to Okta’s own advisory, NVD or CISA, and every incident row to an Okta post or SEC filing.

Key findings

• 41 of the 72 Okta CVEs were published in 2026, against 31 from 2021 through 2025.
• Okta Access Gateway, a customer-run appliance, has 18 CVEs, 15 of them in 2026; 11 came in one September 8, 2026 batch.
• Auth0 SDKs, libraries and connectors account for 26 CVEs, the largest group; they are code customers run in their own apps.
• No CVE in Okta- or Auth0-written code is in CISA KEV (catalog 2026.11.10). The 4 KEV entries are Log4j (2) and PHP (2) flaws in bundled components.
• CISA added the PHP2Shell flaws CVE-2026-109618 and 109619 to KEV on October 26, 2026, 4 days after Okta’s Access Gateway advisory.
• NIST scored 23 Okta-assigned or Auth0 CVEs too, and disagreed with the vendor score on 18: higher on 11, lower on 7.
• Okta’s largest disclosed incident: from September 28 to October 17, 2023, an attacker reached files of 134 customers in its support system and hijacked sessions at 5.

How many Okta vulnerabilities are there?

72 unique CVE IDs. Okta’s security advisories index has 85 advisories covering 70 CVEs, because one flaw can need separate fixes in several SDKs (CVE-2025-48951 has four advisories). NVD lists two more that Okta assigned as a CVE numbering authority but never posted to that index: CVE-2022-3145 in Okta OIDC Middleware and CVE-2024-9875 in the Okta Privileged Access server agent. Of the 72, 65 are flaws in code Okta or Auth0 wrote, and 7 are third-party flaws (Log4j, OpenSSL, PHP) that Okta issued advisories for because its agents or appliance bundle that code.

Searching NVD by product name undercounts badly. NVD’s CPE match for vendor okta returns 27 records, one of which (CVE-2021-45094) is an Imprivata product filed under Okta by mistake. None of the 26 Auth0 SDK, library and connector CVEs mentions Okta in its NVD description, and 14 of them were assigned by GitHub rather than by Okta.

Figure 1. Okta and Auth0 CVEs per year, by product family

Year is the date of Okta’s first advisory for the CVE (NVD publish date for the two NVD-only records). 2026 runs to November 12. Source: trust.okta.com/security-advisories, NVD API 2.0.

Okta vulnerabilities by product

Figure 2. Where the CVEs are, and how many are new this year

Pale bar: all CVEs since 2021. Dark bar: CVEs first published in 2026. Top score excludes the seven bundled Log4j, OpenSSL and PHP flaws. Scores are Okta’s (or the assigning CNA’s) CVSS base score; several Auth0 entries use CVSS v4.

The Okta cloud service itself rarely gets a CVE. When Okta fixes a flaw in its hosted service, it publishes an advisory without one, as it did three times in 2024. The CVEs land in software customers install: the Access Gateway appliance, on-premises agents (AD, LDAP, RADIUS, provisioning, Hyperdrive), desktop and mobile apps, and SDKs. That is why the fixed version matters: nobody upgrades it for you.

The full list: every Okta CVE, severity, fixed version, KEV status

89 rows, newest first, one per advisory and product. Red rows are in CISA KEV. “NIST” is NVD’s own score where NIST has analyzed the record; many 2026 records still read Awaiting Analysis.

Which Okta vulnerabilities are actively exploited?

4 CVEs that Okta published advisories for are in the CISA KEV catalog, version 2026.11.10. None was written by Okta. Two are Apache Log4j flaws in the Okta RADIUS Server Agent and On-Prem MFA Agent from the December 2021 Log4Shell wave. Two are the PHP2Shell runtime flaws bundled in Okta Access Gateway. Okta’s PHP2Shell response says it tested the public proof-of-concept exploits against Access Gateway in its default configuration and none achieved code execution, and that Okta and Auth0 cloud services were not affected. CISA’s listing is about PHP, not about Access Gateway specifically. Our analysis of the KEV catalog shows how short the federal deadlines have become.

Okta vulnerabilities in 2026: what changed

September 8, 2026: 21 CVEs in one day. Okta posted 11 Access Gateway advisories (all fixed in 2026.9.1), four for the Hyperdrive agent and integration plugin (1.5.2), three for the Auth0 AD/LDAP Connector (8.0.0), and single advisories for Okta Verify for Windows, the Privileged Access client and react-native-auth0. The highest Okta score in the batch is 9.0, for stored cross-site scripting in the Auth0 AD/LDAP Connector (CVE-2026-85982). NIST rated the Access Gateway SAML datastore flaw CVE-2026-78623 at 9.9, against Okta’s 7.7.

October 22, 2026: two Access Gateway versions in one day. CVE-2026-115547 (9.1, admin console command execution) and CVE-2026-115546 (8.1, authentication source bypass) are fixed in 2026.10.2. The PHP advisory published the same day names 2026.44.0, which bundles PHP 8.3.36, and Okta’s PHP2Shell post tells Access Gateway customers to upgrade to 2026.44.0. Pages reporting only one of those two numbers are each half right.

November 10, 2026: four Auth0 CVEs. Two cover AI retrieval libraries (auth0-ai-js and auth0-ai-python) that let documents denied by Auth0 FGA reach the model context. The others are in the Auth0 Node.js SDK (fixed in 7.7.1) and ASP.NET Core Authentication SDK (fixed in 1.12.0).

Okta’s advisory text is not always clean, so read the CVE record too. The CVE-2025-7371 advisory for the On-Premises Provisioning agent carries affected-version and fix sections copied from an Auth0 WordPress plugin advisory; the CVE record gives affected versions 2.2.1 up to but not including 2.3.1. The CVE-2026-126129 advisory says the flaw is present in versions “prior to and” resolved in 1.12.0, with the first version missing. The CVE-2026-107372 page says versions before 6.0.2 are affected but names 6.0.3 as the fix.

Okta’s severity scores versus NIST’s

Figure 3. CVSS base score: Okta (or the assigning CNA) against NIST, for the 23 records NIST has scored

NIST rescored 11 of the 23 records higher than the vendor and 7 lower. The widest gaps: CVE-2023-0392 in the LDAP Agent (Okta 3.9, NIST 6.7), CVE-2024-7061 in Okta Verify for Windows (5.5 against 7.8) and CVE-2026-78623 in Access Gateway (7.7 against 9.9). In the other direction NIST put CVE-2026-78626, the Access Gateway Protected Rules flaw, at 6.5 against Okta’s 8.1. If your patch policy keys off a CVSS threshold, decide which score it reads.

Okta flaws fixed without a CVE

Three 2024 issues sat in Okta’s hosted service, so Okta fixed them itself and assigned no CVE. Each still told customers to search their logs.

AD/LDAP Delegated Authentication, 52-character usernames. Okta’s advisory says the cache key was a bcrypt hash of user ID, username and password. A bug introduced July 23, 2024 let a user authenticate with a cached key when the username was 52 characters or longer, MFA was not applied and the AD/LDAP agent was unreachable. Okta found it and fixed it on October 30, 2024 by switching from bcrypt to PBKDF2.

Classic application sign-on policy bypass. From a July 17, 2024 release until October 4, 2024, an attacker with a valid username and password could bypass app-level sign-on policy conditions using a user agent Okta treated as an unknown device type, such as a Python script, per Okta’s advisory.

FastPass phishing-resistance check. On April 5, 2024 a researcher reported that, with a missing origin header, Okta’s backend could count a FastPass sign-in as phishing resistant when it was not. Okta says the root cause was in its backend, not the Okta Verify app, and the fix reached all production cells on April 10.

CVEs that mention Okta but are not Okta’s

NVD keyword searches for “Okta” return flaws in other vendors’ code that integrates with Okta. They belong to those vendors’ patch cycles, not Okta’s. The highest-scored, CVE-2026-63377 (9.8), is in TAKO AI Agent for Okta, an open-source admin tool, not an Okta product.

Okta security incidents, dated

This ledger uses only what Okta itself published on its security blog (sec.okta.com) and Auth0 blog, or filed with the SEC. It leaves out campaigns that targeted Okta customers rather than Okta, such as help desk social engineering against customers, which Okta’s November 29, 2023 update warned about, and third-party breaches Okta did not post about. Okta’s most recent 10-K, filed March 5, 2026, gives two examples of past incidents that harmed its reputation and customer relations: January 2022 and October 2023.

Figure 4. Attacker access and Okta’s disclosures, 2022 to 2024

Red bars are the access windows Okta stated. For the two code repository events Okta gave only “late August” and “early December” 2022, so no bar is drawn.

October 2023: the support system breach, step by step

Okta’s root cause report says the attacker used a service account whose username and password an employee had saved to a personal Google profile signed in on an Okta-managed laptop. The account could view and update support cases. Access ran from September 28 to October 17, 19 days. 1Password reported suspicious activity on September 29 and BeyondTrust on October 2; BeyondTrust supplied the IP address that let Okta find the account on October 16. Okta disabled it on October 17 and published its advisory on October 20, 3 days after containment and 21 days after the first customer report.

Okta’s timeline explains part of the delay: for 14 days its log searches missed the downloads, because opening files from the Files tab writes a different log event than opening them from a case. The scope then grew twice. On November 3 Okta put it at 134 customers, under 1%, with 5 customers’ sessions hijacked using tokens from HAR files. On November 29, 62 days after the attacker ran it, Okta disclosed that a report with the names and email addresses of all its customer support system users had been downloaded. For 99.6% of users the only contact data in it was name and email. Okta closed the investigation on February 8, 2024, after Stroz Friedberg’s review, 133 days after the first access.

The same November 29 update said 94% of Okta customers already required MFA for administrators, and urged the rest to adopt phishing-resistant factors. Our MFA statistics show how adoption looks outside Okta’s customer base.

January 2022: the LAPSUS$ screenshots

LAPSUS$ posted screenshots on March 21, 2022. Okta’s statement the next day said an attacker had a support engineer’s laptop at a third-party provider for five days, January 16 to 21, 60 days before that statement. Okta’s March 25 8-K put the maximum potential impact at 366 customers, about 2.5%. Its April 19 8-K/A cut that to 2 customer tenants: the attacker controlled one workstation for 25 consecutive minutes on January 21 and could not change configurations, reset MFA or passwords, or authenticate to Okta accounts. Both filings say Okta did not consider the incident material.

2022: two source code events

On September 26, 2022 Okta disclosed that an outside party had told it in late August that it held copies of Auth0 code repositories from October 2020 and earlier, before Okta acquired Auth0. On December 21, 2022 it disclosed that GitHub had flagged suspicious access in early December, used to copy Okta Workforce Identity Cloud repositories. In both cases Okta said it found no access to customer data or the production service. Okta also says it does not rely on the confidentiality of its source code for the security of its services.

What this means for MSPs

Inventory the Okta software you host, not the tenant. All 72 CVEs are in installed software: Access Gateway appliances, AD, LDAP and RADIUS agents, the On-Premises Provisioning and Hyperdrive agents, Okta Verify, the browser plugin and SDKs. List versions per client. The AD agent fix (3.12.0) needed an uninstall and reinstall, because the auto-update service could not deploy it.

Treat Access Gateway as an internet-facing appliance. It has 18 CVEs, 15 in 2026, and it carries the two PHP2Shell KEV entries. Upgrade to 2026.44.0 and keep it on the same footing as VPN concentrators and other edge devices in the change calendar.

Push Okta Verify and agent updates through RMM. Okta Verify for Windows has needed four fixes since March 2024 (4.10.7, 5.0.2, 5.3.3 and 7.0.1), and the RADIUS agent needs 2.28.0 for two October 2026 CVEs. Okta gives System Log queries in several advisories to find users on old versions; run them per client tenant.

Watch the Auth0 SDKs if you build apps. 26 CVEs sit in Auth0 libraries that ship inside your own code, from nextjs-auth0 (five advisories) to the PHP family. Dependency scanners pick these up from GitHub advisories even when NVD never names Okta.

Use the incident record in vendor reviews, not the CVE count. Both incidents Okta’s 10-K names came through support channels: a vendor’s support laptop in 2022 and Okta’s own support case system in 2023. Strip session tokens and cookies from HAR files before uploading them to any vendor, which Okta itself now recommends, and require phishing-resistant MFA on admin accounts, the step Okta pressed in its November 29, 2023 update and again in its 2024 advisories. Broader context on patch volume is in our CVE statistics for 2026.

Frequently asked questions

Is Okta secure?

Okta’s own advisory index lists 70 CVE IDs, and NVD adds 2 more Okta assigned, for 72 in total since 2021. None of the 65 flaws in Okta or Auth0 code is in CISA’s Known Exploited Vulnerabilities catalog as of version 2026.11.10. The 4 KEV entries tied to Okta products are Log4j and PHP flaws in bundled third-party components. Okta has disclosed 4 security incidents since 2022, the largest in October 2023, when files tied to 134 customers were accessed in its support system.

Is Okta Verify safe to use?

Okta Verify has 5 CVEs, the latest CVE-2026-78622 (CVSS 6.0, fixed in Okta Verify for Windows 7.0.1), and none is in CISA KEV. The most serious, CVE-2024-10327 (8.1), let iOS push responses approve a sign-in whichever option the user chose; Okta shipped 9.27.2 on October 23, 2024, two days after 9.27.0 reached the App Store, and says vulnerable versions can no longer authenticate.

What Okta vulnerabilities were disclosed in 2025?

Okta’s advisories list 13 CVEs first published in 2025, 10 of them in Auth0 SDKs and libraries. The highest scores were 9.3 (CVSS v4) for CVE-2025-48951 in the Auth0-PHP SDK and CVE-2025-46572 in passport-wsfed-saml2, and 9.1 for CVE-2025-47275 in Auth0-PHP cookie sessions. None is in CISA KEV.

What are the Okta vulnerabilities in 2026?

41 CVEs so far, more than 2021 through 2025 combined (31). The September 8, 2026 batch alone had 21, 11 of them in Okta Access Gateway (fixed in 2026.9.1). The highest Okta-scored 2026 CVE is CVE-2026-115547 (9.1) in the Access Gateway admin console, fixed in 2026.10.2. The PHP flaws CVE-2026-109618 and 109619 in Access Gateway are in KEV, fixed in 2026.44.0.

How do I report an Okta vulnerability?

Okta’s security advisories page links a Report a Vulnerability form and two Bugcrowd bug bounty programs, bugcrowd.com/okta and bugcrowd.com/auth0-okta. Okta publishes fixed issues on trust.okta.com/security-advisories, which also offers an RSS feed.

Did Okta file an 8-K for the October 2023 breach?

No. Okta’s 8-Ks filed between October 2023 and February 2024 cover quarterly results (November 29, 2023) and a restructuring (February 1, 2024). Okta’s only incident 8-Ks are from March 25 and April 19, 2022, about the January 2022 support vendor compromise. The October 2023 incident appears in the 10-Q filed December 1, 2023 and in later 10-Ks, including the one filed March 5, 2026.

Free to cite and republish with a link.

Methodology

References

1. Okta, Security Advisories (index and 85 advisory pages). Accessed November 2026.
2. NIST NVD API 2.0. Accessed November 2026.
3. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
4. CVE Program records, cveawg.mitre.org API. Accessed November 2026.
5. Okta, Okta’s Response to PHP2Shell. Accessed November 2026.
6. Okta, Okta Verify Vulnerability Disclosure Report: Response and Remediation. Accessed November 2026.
7. Okta, Tracking Unauthorized Access to Okta’s Support System. Accessed November 2026.
8. Okta, Unauthorized Access to Okta’s Support Case Management System: Root Cause and Remediation. Accessed November 2026.
9. Okta, October Customer Support Security Incident: Update and Recommended Actions. Accessed November 2026.
10. Okta, October 2023 Security Incident Investigation Closure. Accessed November 2026.
11. Okta, Official Okta Statement on LAPSUS$ Claims. Accessed November 2026.
12. Okta, Auth0 Code Repository Archives From 2020 and Earlier and Auth0 blog post. Accessed November 2026.
13. Okta, Okta Code Repositories. Accessed November 2026.
14. Okta, Social Engineering Impersonation Report. Accessed November 2026.
15. Okta, Form 8-K, March 25, 2022 and Form 8-K/A, April 19, 2022. Accessed November 2026.
16. Okta, Form 10-Q for the quarter ended October 31, 2023, Form 10-K, fiscal 2024 and Form 10-K, fiscal 2026. Accessed November 2026.
17. SEC EDGAR, Okta filing index (CIK 1660134). Accessed November 2026.