← Vulnerability feed

Vulnerability record · CVE-2021-28113 · published 2 April 2021

CVE-2021-28113: Okta access gateway os command injection vulnerability

Okta · Access Gateway

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.

6.7 CVSS 3.1 Medium EPSS 22% · top 2.4% CWE-78 · OS command injection
6.7CVSS 3.1 base score, v2 8.7
22%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers (with admin access to the Okta Access Gateway UI) to execute OS commands as a privileged system account.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html ExploitThird Party AdvisoryVDB Entry
https://www.okta.com/security-advisories/cve-2021-28113 Vendor Advisory
http://packetstormsecurity.com/files/163428/Okta-Access-Gateway-2020.5.5-Authenticated-Remote-Root.html ExploitThird Party AdvisoryVDB Entry
https://www.okta.com/security-advisories/cve-2021-28113 Vendor Advisory

Track CVE-2021-28113 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-78623Okta access gateway sql injection vulnerabilityThe Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore config…EPSS 0.45%6.7CVE-2026-78630Okta access gateway os command injection vulnerabilityThe Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS co…EPSS 0.22%6.7CVE-2026-78625Okta access gateway code injection vulnerabilityThe Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is au…EPSS 0.23%6.5CVE-2026-78626Okta access gateway incorrect authorization vulnerabilityThe Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, result…EPSS 0.36%6.5CVE-2026-78560Okta access gateway improper authentication vulnerabilityThe Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without…EPSS 0.20%6.5CVE-2026-78579Okta access gateway ldap injection vulnerabilityThe Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore co…EPSS 0.24%4.9CVE-2026-78624Okta access gateway path traversal vulnerabilityThe Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file …EPSS 0.46%4.9CVE-2026-78552Okta access gateway vulnerabilityThe Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated d…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2021-28113), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.