What was fixed
Both vendors disclosed these issues on 8 September:
- Auth0 AD/LDAP Connector: CVE-2026-85982, rated CVSS 9.0, is fixed in version 8.0.0.
- Okta Access Gateway: update to 2026.9.1 to fix CVE-2026-78626 and CVE-2026-78623.
Does it affect you?
These fixes are for software that you install and operate yourself. They only matter if you run the Auth0 AD/LDAP Connector or Okta Access Gateway in your own environment. If you only use the vendors' hosted services, there is no connector or gateway of yours to update, but read the vendors' notices to confirm that.
How to check
- Search your server inventory and software lists for the AD/LDAP Connector and for Okta Access Gateway, including test and disaster-recovery copies.
- Read the installed version from the product's own admin screen or package list.
- Compare it with the fixed versions above and plan the update.
These products sit between your identity provider and your internal systems, so schedule the update with the teams that depend on sign-in, and test sign-in afterwards.
After updating
- Confirm the new version is running and that sign-in works for each application behind it.
- Review sign-in and administration logs since 8 September for activity you do not recognise.
- Rotate credentials stored on the machine if you have any reason to doubt it.
In short
If you run the Auth0 AD/LDAP Connector, move to 8.0.0. If you run Okta Access Gateway, move to 2026.9.1. If you run neither, no action is needed for these issues. Schedule an Identity and Cloud Security Review and we will check how your identity systems are protected.