CVE-2026-917787.2HighCWE-863
Octopus Deploy Octopus Server vulnerability
Octopus Deploy · Octopus Server
Not in CISA KEVVendor fix available
0.4%probability of exploitation in the next 30 days
37th percentile
050100
Higher than 37% of scored CVEs
7.2HighCVSS 4.0
LowMediumHighCrit.
DescriptionNVD
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Sep.
- Octopus Deploy Fixes Flaws That Could Enable Remote Code ExecutionSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.