Octopus Server CVE-2026-8296

Exploitation requires the attacker to hold a high-privilege account on Octopus Server with permission to create or upload artifacts (PR:H per CVSS 4.0 vector). Attack complexity is rated High (AC:H), indicating that exploitation is not straightforward and likely depends on specific configurations, timing, or artifact display contexts within the UI. Active user interaction (UI:A) from a victim is mandatory - the payload does not self-execute server-side. What limits exploitation: the attacker cannot be unauthenticated or low-privileged; the victim must navigate to or interact with the artifact-containing view; and impact is confidentiality-only with no integrity or availability consequence on any system (VI:N, VA:N, SC:N, SI:N, SA:N). Environments that enforce least-privilege RBAC for artifact management are meaningfully more resistant to this attack.

The CVSS 4.0 score of 5.6 (Medium) accurately reflects a vulnerability with meaningful confidentiality impact but layered prerequisites that substantially reduce exploitability in practice. The vector AV:N/AC:H/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N signals three compounding friction points: the attacker must already hold high-privilege credentials, the attack complexity is rated High (suggesting race conditions or specific configuration states), and a victim must actively interact with the malicious artifact. There is no KEV listing, no identified public exploit code, and no EPSS data in the provided intelligence. The net real-world risk is moderate-to-low - this is unlikely to be opportunistically exploited at scale but could be a meaningful insider threat vector or post-compromise escalation step in environments where deployment engineers have artifact upload rights over operations or security teams. The absence of integrity and availability impact further constrains blast radius.

An attacker who has obtained or legitimately holds a high-privilege Octopus Server account (e.g., a deployment engineer or compromised service account) uploads an artifact to a deployment or runbook containing a crafted filename or embedded content with an XSS payload. When a target user - such as an operations engineer or security reviewer - views the deployment summary or artifact listing in their browser, the payload executes and exfiltrates their session cookie to an attacker-controlled endpoint, enabling session hijacking without requiring the attacker to know the victim's credentials.