Octopus Deploy Vulnerability Allows Remote File Manipulation

CERT-Bund has released security advisory WID-SEC-2026-0742 concerning a critical vulnerability in Octopus Deploy. The vulnerability, rated with a CVSS Base Score of 4.3, allows a remote, authenticated attacker to manipulate files on affected systems. The advisory lists specific affected versions of Octopus Deploy, including those prior to 2026.1.11242, 2025.3.14731, 2025.4.10359, and 2026.1.5571, and notes that the vulnerability impacts both Linux and Windows operating systems.

Organizations using the affected versions of Octopus Deploy should review the advisory for mitigation strategies and consider applying available patches or updates to prevent exploitation. While the advisory does not specify a direct compliance deadline, prompt remediation is advised to address the security risk. Failure to mitigate could lead to unauthorized file manipulation, potentially impacting software deployment integrity and system security.