DeutschShown in its original language — a full translation is planned for a future version.
Octopus Deploy: Mehrere Schwachstellen
view advisory published 2026-10-26
Ein Angreifer kann mehrere Schwachstellen in Octopus Deploy ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, um Dateien zu manipulieren, und um beliebigen Programmcode auszuführen.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-12887US | — | — | ||
In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent dire… | ||||
| CVE-2026-117466US | — | — | ||
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator. | ||||
| CVE-2026-117341US | — | — | ||
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space… | ||||
| CVE-2026-116870US | — | — | ||
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate iss… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan