Vulnerability details
CVE-2026-78210
Octopus Deploy Octopus Server
CVSS 4.0
7.1High
Official description
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 4.0 | CVEProject cvelistV5 (CNA) (Octopus) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Octopus Deploy | Octopus Server | 2019.5.9 ≤ v < 2026.1.11739 | CVEProject cvelistV5 (CNA) |
| Octopus Deploy | Octopus Server | 2026.2.0 ≤ v < 2026.2.13364 | CVEProject cvelistV5 (CNA) |
| Octopus Deploy | Octopus Server | 2026.3.0 ≤ v < 2026.3.13951 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-01
- Last updated
- 2026-10-01
- State
- Published
- Assigner (CNA)
- Octopus
Exploit prediction (EPSS)
0.25%
Probability of exploitation in 30 days
17.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-863Incorrect Authorization