CVE WatchSep 8, 2026

CVE-2026-78552

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is inter

CVSS

6.0

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-693

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.

Official references

trust.okta.comhttps://trust.okta.com/security-advisories/validation-bypass-in-okta-access-gateway-custom-directives-cve-2026-78552

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-286647.8 HIG

—

———In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.6h CVE-2026-813769.6 CRI

—

———Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.8h CVE-2026-778926.8 MED

—

———No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack.8h CVE-2026-848116.5 MED

21.0%

——6agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.5d CVE-2026-848106.5 MED

17.8%

——5claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE verdict with 100/100 trust score despite containing unanalyzed executable payloads.6d CVE-2026-848096.5 MED

24.0%

——7Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.5d