Privilege Escalation Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-117466

8.6HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117466?

Affected versions of Octopus Server allow a user with the System Manager role to escalate their privileges to become a full system Administrator. This vulnerability can lead to unauthorized access and modification of critical system settings, potentially compromising the security of the entire deployment environment. Users are encouraged to review their system roles to mitigate risks associated with this weakness.

Affected Version(s)

Octopus Server Windows 2019.0.0 < 2026.2.13469

Octopus Server Windows 2026.3.0 < 2026.3.15863

References

https://advisories.octopus.com/post/2026/sa2026-17

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.