Approximately 40,000-41,000 U.S. Department of Homeland Security employees and contractors had personal and operational details exposed in a data breach. Attackers claimed access through Okta's single sign-on system and published records including contact information, internal group memberships, and details tied to undercover ICE operations. Okta has stated its core systems were not compromised. The breach highlights risks to federal agencies relying on single sign-on services for authentication.
CVE-2026-63377 is a critical unauthenticated setup bypass in TAKO AI Agent for Okta (versions prior to 3.0.1-beta) with CVSS 9.8 score. The vulnerable POST /api/auth/setup endpoint lacks authentication controls, allowing remote attackers to create administrator accounts before initial setup completion. Successful exploitation grants full administrative access to Okta-synced user data, API tokens, and service control. The default Docker configuration exposes the service on 0.0.0.0, broadening attack surface.
Okta fixed CVE-2026-115547, a code injection vulnerability in Okta Access Gateway Admin Console with CVSS score 9.1. The flaw allows authenticated administrators to execute system commands within the OAG service context. No public exploitation recorded as of disclosure. Affected customers must upgrade to version 2026.10.2 or greater; no workaround available.
Researchers identified Unicode exploitation technique that creates convincing Okta lookalike domains to bypass browser defenses. Attack chains Cyrillic and Latin character spoofing to deceive users into credential theft. Researchers registered 20 impersonation domains targeting multiple brands including Okta, demonstrating viable phishing bypass against Chrome and Edge.
Okta disclosed three vulnerabilities on September 8, 2026 affecting Auth0 AD/LDAP Connector and Okta Access Gateway: CVE-2026-85982 (stored XSS, CVSS 9.0) enabling arbitrary JavaScript execution in administrator browsers; CVE-2026-78626 (authorization bypass, CVSS 8.1) in Protected Rules; and CVE-2026-78623 (SQL injection, CVSS 7.7) in advanced-mode datastores. Patches are available in Auth0 connector 8.0.0 and Access Gateway 2026.9.1.
ShinyHunters breached McKesson by calling the company's helpdesk and using vishing to reset Okta single sign-on credentials on August 21, 2026. The attackers gained access to internal Salesforce and Snowflake systems, exfiltrating approximately 1 terabyte of data including up to 284 million patient records (names, SSNs, addresses, medical histories). ShinyHunters demanded $55.2 million in ransom. This demonstrates that Okta authentication can be compromised through helpdesk social engineering even without exploiting Okta's software.
ShinyHunters used voice-phishing (vishing) to compromise Okta SSO credentials at McKesson Corporation, then pivoted to Snowflake and Salesforce to steal approximately 284 million patient records including names, SSNs, dates of birth, medical information, and Medicaid numbers between August 21–25, 2026. McKesson confirmed the breach on August 28. The group demanded $55.2 million ransom and has executed similar Okta-to-cloud-data attacks against multiple organizations in 2026, establishing a pattern where compromised SSO credentials enable large-scale data exfiltration.
ShinyHunters extortion group is actively targeting healthcare organizations in a vishing campaign to reset Okta SSO credentials and MFA. Attackers impersonate employees to trick help desks into performing password resets, granting legitimate access to Okta accounts and downstream cloud platforms like Microsoft 365 and SharePoint for data exfiltration. Health-ISAC issued a major advisory on July 24, 2026 warning of this attack pattern.
Google's Threat Intelligence Group is tracking UNC6671, a cybercrime group conducting voice phishing attacks to hijack Okta accounts and exfiltrate corporate data for extortion. Attackers impersonate internal IT helpdesk staff, directing victims to adversary-in-the-middle phishing sites that capture credentials and MFA tokens. Since July 2026, the group has prioritized financial services, private equity, law firms, and rating agencies. Multiple campaigns share infrastructure under brand names including Falcon, Helix, Pink, and Redact.
Okta Red Team disclosed HollowByte, a denial-of-service vulnerability in OpenSSL triggered by 11-byte malicious TLS handshake headers. The flaw causes memory exhaustion and heap fragmentation on glibc systems; unpatched servers can have significant RAM locked up by a single attacker. OpenSSL patched the issue in June 2026 releases without assigning a CVE or formal advisory, complicating discovery and deployment tracking.
Okta has issued a security advisory warning organizations of an ongoing vishing campaign exploiting Microsoft 365 users. The threat actor, tracked as O-UNC-066 (also known as Pink/CL-CRI-1147), has been conducting voice-enabled attacks since April 2026 to harvest Microsoft Entra ID credentials. Attackers direct victims to fake passkey enrollment pages designed to mimic legitimate Microsoft interfaces. Multiple sectors including automotive, aviation, healthcare, and technology have been targeted, primarily for data extortion purposes.