// OktaHIGH
Okta disclosed three vulnerabilities on September 8, 2026 affecting Auth0 AD/LDAP Connector and Okta Access Gateway: CVE-2026-85982 (stored XSS, CVSS 9.0) enabling arbitrary JavaScript execution in administrator browsers; CVE-2026-78626 (authorization bypass, CVSS 8.1) in Protected Rules; and CVE-2026-78623 (SQL injection, CVSS 7.7) in advanced-mode datastores. Patches are available in Auth0 connector 8.0.0 and Access Gateway 2026.9.1.
// Get alerts for Okta