Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-101169

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically…

High8.7EPSS 0.35%
Published
Updated
Reserved
Assigned by
Octopus

Description

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process.

Scores

CVSS scores of CVE-2026-101169, by who scored it
Scored byCVSSScoreVector
OctopusCNA (assigner)4.0High8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Awaiting Analysis4.0High8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.35% · top 72% of all CVEs (5 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

Affected products

  • Octopus Deploy · Octopus Server

    • affected 2019.4.1 – < 2026.1.11781
    • affected 2026.2.0 – < 2026.2.13441
    • affected 2026.3.0 – < 2026.3.15829

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-101169 badge
[![CVE-2026-101169](https://trackcve.app/badge/CVE-2026-101169.svg)](https://trackcve.app/cve/CVE-2026-101169)

Record last updated .