Octopus Server Flaw Lets Authenticated Users Execute Code Through Insecure JSON Deserialization
Octopus Deploy patched high-severity CVE-2026-101169, an authenticated RCE via insecure JSON deserialization of Environment and Project objects in Octopus Server.
CVE-2026-101169 allows authenticated users with permission to edit Environment or Project objects to submit crafted JSON that executes arbitrary code inside the Octopus Server process on Linux and Windows. The flaw affects releases from 2019.4.x through 2025.x and 2026 branches before 2026.1.11781, 2026.2.13441, 2026.3.15829, and 2026.4.1619. Patches shipped September 14, 2026, with no workaround available; Octopus Cloud instances are already patched. Octopus Deploy says it is unaware of any exploitation.
- CVE-2026-101169 lets authenticated users with Environment/Project edit rights achieve RCE via JSON deserialization.
- Affects Octopus Server 2019.4.x through 2025.x and 2026 branches before 2026.1.11781, 2026.2.13441, 2026.3.15829, 2026.4.1619.
- No mitigation available; Octopus Cloud already patched; vendor unaware of exploitation.
- Compromised admin or delegated project permissions could expose deployment credentials and infrastructure targets.
- CVEs
- CVE-2026-101169
- Organizations
- Octopus Deploy
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101169 | Authenticated deserialization RCE in Octopus Server | 8.7 | — |
From the original article
2 min read at cybersecuritynews.com
Octopus Deploy has disclosed a high-severity vulnerability in Octopus Server that could allow authenticated users to execute arbitrary code on affected servers through insecure JSON deserialization. Tracked as CVE-2026-101169, the flaw affects Octopus Server deployments on Linux and Microsoft Windows. The company released Security Advisory 2026-10 on September 29, 2026, and urged customers to upgrade […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.