EUVD-2026-88654
GHSA-cj2p-238w-jrf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low complexity, requires an authenticated user with Environment/Project edit rights (PR:L); deserialization yields full code execution in-process (C/I/A:H), scope unchanged.
Primary rating from Vendor (Octopus).
CVSS VectorVendor: Octopus
Lifecycle Timeline
3DescriptionCVE.org
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.
AnalysisAI
Authenticated remote code execution in Octopus Server allows any user whose role grants permission to edit an Environment or a Project to store specifically crafted JSON on that object, which the server then deserializes insecurely and executes as arbitrary code inside the Octopus Server process. Exploitation requires a valid account and that specific edit permission but no user interaction and no non-default configuration, and it delivers full loss of confidentiality, integrity, and availability to the deployment platform; the practical threat comes from malicious insiders, over-provisioned users, or attackers who have already compromised an account holding Environment/Project edit rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Octopus Server account whose role grants permission to edit an Environment or a Project; the attacker sets specifically crafted JSON content on that object, which the server insecurely deserializes into code execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable priority for organizations running Octopus Server, though not a mass-exploitation emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version is present in the supplied data, and no vendor-released patch version has been independently confirmed here, so the first action is to consult the vendor advisory SA2026-10 at https://advisories.octopus.com/post/2026/sa2026-10 and apply the upgrade it prescribes for the affected Octopus Server release line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict the ability to edit Environments and Projects in Octopus Server to only essential trusted administrators, review all accounts and roles that currently hold those permissions, and enable detailed audit logging and alerting for suspicious Octopus Server process execution or unexpected JSON edits. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Octopus Server
View allIn Octopus Deploy 2018.8.0 through 2018.9.x before 2018.9.1, an authenticated user with permission to modify deployment
In Octopus Deploy 2019.1.0 through 2019.3.1 and 2019.4.0 through 2019.4.5, an authenticated user with the VariableViewUn
Server-level configuration changes can be made by any authenticated low-privilege user in Octopus Server through a speci
In affected versions of Octopus Server where access is managed by an external authentication provider, it was possible t
In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes. Rated critical
In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va
Path traversal in Octopus Deploy allows removing files and file contents on the host through API manipulation. Enables d
In affected versions of Octopus Server it is possible for a session token to be valid indefinitely due to improper valid
Path traversal in Octopus Server allows an authenticated low-privilege user to overwrite arbitrary files on the server f
Privilege escalation in Octopus Server lets an authenticated user who already holds permission to modify roles weaken a
Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorre
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsof
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today