CVE-2026-117466High· 8.6▾ TwilightIn affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
octopus_server >= 2019.0.0 < 2026.2.13469octopus_server >= 2026.3.0 < 2026.3.15863Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118426Medium· 5.3In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.
CVE-2026-12887Medium· 5.1In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.
CVE-2026-116870High· 8.7In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently
CVE-2026-117341High· 7.7In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log
CVE-2026-102488High· 8.7In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
CVE-2026-102478High· 8.7In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation