Auth0 and Okta security fixes: CVE-2026-85982, CVE-2026-78626 and CVE-2026-78623

Auth0 and Okta each disclosed security fixes on 8 September 2026. Both cover software that sits between an identity provider and the systems behind it, which is why a flaw there is worth a fast answer: someone who gets control of the component can influence who signs in to what.

What was fixed

• Auth0 AD/LDAP Connector: CVE-2026-85982, rated CVSS 9.0, is fixed in version 8.0.0.
• Okta Access Gateway: update to 2026.9.1 to fix CVE-2026-78626 and CVE-2026-78623.

Does it affect you?

These fixes are for software that you install and operate yourself. They only matter if you run the Auth0 AD/LDAP Connector or Okta Access Gateway in your own environment. If you only use the vendors' hosted services, there is no connector or gateway of yours to update, but read the vendors' notices to confirm that.

How to check

• Search your server inventory and software lists for the AD/LDAP Connector and for Okta Access Gateway, including test and disaster-recovery copies.
• Read the installed version from the product's own admin screen or package list.
• Compare it with the fixed versions above and plan the update.

These products sit between your identity provider and your internal systems, so schedule the update with the teams that depend on sign-in, and test sign-in afterwards. Identity components are also a place where attackers look for a way around your controls: MFA fatigue attacks fall where number matching is enforced, but only for sign-ins that actually pass through the protected path.

After updating

• Confirm the new version is running and that sign-in works for each application behind it.
• Review sign-in and administration logs since 8 September for activity you do not recognise.
• Rotate credentials stored on the machine if you have any reason to doubt it.

The bottom line

If you run the Auth0 AD/LDAP Connector, move to 8.0.0. If you run Okta Access Gateway, move to 2026.9.1. If you run neither, no action is needed for these issues. Insurers now ask how identity is protected, too: see how insurers price phishing-resistant MFA adoption.