Octopus Server CVE-2026-12887

Exploitation requires an authenticated Octopus Server user who holds permission to upload a NuGet package and to configure/deploy a script step (PR:H) - i.e., existing elevated project or deployment privileges within Octopus. There is no user-interaction requirement (UI:N), but the high privilege prerequisite is the primary limiting factor, confining realistic exploitation to malicious insiders or compromised privileged accounts rather than anonymous remote attackers. Affected deployments are Octopus Server branches 2026.1 (<2026.1.674), 2026.2 (<2026.2.973), 2026.3 (<2026.3.5839), and 2023.0.0 through <2026.1.674; upgrading to the listed fixed versions is the vendor-provided remediation.

This is a moderate-severity, low-urgency issue rather than a top priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L) scores 5.1 and tells a consistent story: although reachable over the network, exploitation requires high privileges (PR:H) - specifically an Octopus user who already holds permission to upload NuGet packages and configure deployment steps - and the impact is limited to low integrity and low availability with no confidentiality loss (VC:N). No EPSS score, no CISA KEV listing, and no proof-of-concept were provided, so there is no signal of active or probable near-term exploitation; the vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the limited impact and high privilege requirement. The signals are therefore internally consistent and point to an insider/abuse-of-privilege scenario rather than a mass-exploitable flaw. One cross-reference note: the input tag 'Information Disclosure' conflicts with VC:N (no confidentiality impact), so that categorization should be treated with caution - the described behavior is a deployment directory-escape affecting integrity/availability, not disclosure.

An authenticated Octopus Server user who already holds permission to upload NuGet packages crafts a malicious package and configures a script step so the script executes outside its intended parent directory on the deployment target. No public exploit code was identified, and because the actor must already possess elevated project/deployment privileges, this is realistically an abuse-of-privilege or insider scenario rather than opportunistic external attack.