Insecure Deserialization Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-101169

8.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
29 September 2026

What is CVE-2026-101169?

In certain versions of Octopus Server, an authenticated user with edit permissions for an Environment or Project can input specially crafted JSON content. This insecure deserialization can potentially allow the user to execute arbitrary code within the Octopus Server process, leading to serious security implications. Users are urged to review the recent advisories and apply appropriate patches to mitigate this vulnerability.

Affected Version(s)

Octopus Server Windows 2019.4.1 < 2026.1.11781

Octopus Server Windows 2026.2.0 < 2026.2.13441

Octopus Server Windows 2026.3.0 < 2026.3.15829

References

https://advisories.octopus.com/post/2026/sa2026-10

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.