CVE-2026-101169

CVE-2026-101169 is an insecure deserialization flaw (CWE-502) in Octopus Server. An authenticated user who can edit an Environment or Project can store specially crafted JSON on that object; when the server deserializes it, the attacker can run arbitrary code inside the Octopus Server process. Successful exploitation yields high confidentiality, integrity, and availability impact on the server itself (CVSS 4.0 8.7), but it requires valid credentials and edit permission and does not, on the published vector, extend to other systems. Organizations running affected Octopus Server versions are at risk, especially where Environment or Project editing is broadly granted. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the Octopus security update for affected Octopus Server releases as soon as the vendor publishes patched builds, and treat Environment and Project edit rights as high privilege. Until patched, restrict those permissions to trusted administrators, review recent Environment and Project changes for unexpected JSON, and monitor the Octopus Server process and host for unusual code execution.