Script Execution Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-12887

5.1MEDIUM

Key Information:

Vendor: Octopus Deploy
Status: Octopus Server
Vendor: CVE Published:; 27 October 2026

🔔 Create Octopus Deploy Vulnerability Alert

What is CVE-2026-12887?

In certain versions of Octopus Server, a flaw exists that allows users with upload permissions to a malicious nuget package to deploy a script that executes outside of its intended parent directory. This improper handling of script execution poses risks, as it can lead to unauthorized command execution and potential system compromise.

Affected Version(s)

Octopus Server Windows 2023.0.0 < 2026.1.674

Octopus Server Windows 2026.1 < 2026.1.674

Octopus Server Windows 2026.2 < 2026.2.973

References

https://advisories.octopus.com/post/2026/sa2026-14/

CVSS V4

Score:

5.1

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 27, 2026
Vulnerability Reserved
Jun 22, 2026

Credit

This vulnerability was found by siddharthkathole62bb60

CVE-2026-12887 Data

JSON