All vulnerabilities
CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of t

Octopus Deploy Octopus Server
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026.1.11781Also 2026.2.13441, 2026.3.15829CVE List
Published29 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

Text from CVE List

Affected versions 3

  • Octopus Serveraffected: 2019.4.1 before 2026.1.11781CVE List
  • Octopus Serveraffected: 2026.2.0 before 2026.2.13441CVE List
  • Octopus Serveraffected: 2026.3.0 before 2026.3.15829CVE List

References 1