Path Traversal Vulnerability in Octopus Server by Octopus Deploy
CVE-2026-92355

8.7HIGH

Key Information:

Vendor

Octopus Deploy

Status
Octopus Server
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92355?

An exploitable path traversal vulnerability in Octopus Server allows users with permission to modify non built-in external feeds to overwrite arbitrary files on the server. This flaw could potentially result in remote code execution under certain configurations, posing significant security risks.

Affected Version(s)

Octopus Server Windows 2024.1.4131 < 2026.1.11725

Octopus Server Windows 2026.2.0 < 2026.2.13344

Octopus Server Windows 2026.3.0 < 2026.3.11816

References

https://advisories.octopus.com/post/2026/sa2026-09

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was found by Nathan Willoughby
.