Okta and Auth0 security advisories plus Okta service incidents (SSO, MFA, Workflows, Access Gateway).
80 changes, newest first
LowService Health
Office 365 Domain Federation Failures
I-11904 · Impact: Service degradation — Resolved. Service: Single Sign-On. On October 29, 2026, at 6:45 AM PT, the Okta Engineering Team became aware of an issue with our domain federation management service. Administrators may be unable to add or update domain federations. Existing single sign-on (SSO) and end-user login sessions continue to function normally. Our engineering team is actively monitoring a…
Degraded Performance: Delays in Outbound SMS Delivery
I-11899 · Impact: Service degradation — Resolved. Service: MFA. On October 28, 2026, at 9:45 AM PT, the Engineering Team became aware of an issue with the email service that caused delayed or failed delivery of outbound SMS messages, including two-factor authentication (2FA) verification codes and SMS alerts. Initial findings indicate this is tied to a service disruption with our downstream telephony carrier, China…
Two critical remote code execution vulnerabilities, collectively referred to as PHP2Shell, were disclosed in PHP on October 21, 2026. The Okta Access Gateway includes a PHP runtime component affected by these vulnerabilities. To remediate, upgrade your Okta Access Gateway appliance version to 2026.44.0
Command Execution via Admin Console Input in Okta Access Gateway CVE-2026-115547
CVE-2026-115547 · CVSS 9.1 — An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.
Authentication Source Verification Issue in Okta Access Gateway CVE-2026-115546
CVE-2026-115546 · CVSS 8.1 — Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. To remediate this vulnerability, upgrade the Okta Access Gateway appliance to version 2026.10.2 or greater.
I-11835 · Impact: Feature disruption — Resolved. Service: API Services. On October 21, 2026, at 11:00 AM PT, Engineering became aware of an issue with our cloud vendor affecting reporting services on EMEA Cell 9. During this time, reporting will not be available. Our team is actively working with our cloud vendor to mitigate the issue. We will provide another update within the next 1 hour, or sooner if additional…
I-11832 · Impact: Service disruption — Resolved. Service: Core Platform. On October 21, 2026, at 11:49 AM PT, the Engineering Team became aware of an issue with Group Push affecting our customers in US Cell 3. Impacted customers may experience delays with group push imports. We will provide another update within the next 30 minutes, or sooner if additional information becomes available.
I-11743 · Impact: Service degradation — Resolved. Service: Core Platform. At 10/13/2026 6:00 AM PT, the Okta team became aware of an issue with Group Push affecting customer operations in EMEA Cell 1. Our team is actively investigating this issue and to mitigate the issue. We will provide another update within the next 30 minutes, or sooner if additional information becomes available.
I-11740 · Impact: Service disruption — Resolved. Service: Core Platform. At 13/10/2026 00:50 PT, the team became aware of an issue with to our Core Platform service affecting customers in EMEA Cell 1. During this time, users may be experiencing intermittent issues within our system. Our team is actively investigating this issue. We will provide another update within the next 30 minutes, or sooner if additional…
Improper Input Validation in the Okta Credential Provider for Windows CVE-2026-78628
CVE-2026-78628 · CVSS 6.0 — The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. To remediate, upgrade the Okta Credential Provider for Windows to version 1.4.6.0 or greater.
