Is CVE-2026-118426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118426 being exploited in the wild.

How severe is CVE-2026-118426?

Informational severity, published 29 October 2026.

Which products and versions are affected?

Octopus Deploy Octopus Server All 3.x.x, 4.x.x; 2018.x through 2022.x; 2023.x, 2024.x, 2025.x, 2026.1.x; 2026.2.x before 2026.2.13487; 2026.3.x before 2026.3.15909.

Is there a fix for CVE-2026-118426?

Yes: fixed in Octopus Server 2026.2.13487, 2026.3.15909 or higher. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118426 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-118426?

Check whether you run Octopus Deploy Octopus Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118426: Octopus Server LDAP directory enumeration

CVE-2026-118426 · Severity: info · Published 2026-10-29

Octopus Server is a continuous deployment platform that manages automated application releases. When LDAP authentication is enabled, any authenticated user can enumerate LDAP users and groups in the directory, revealing organizational structure and account information they should not access.

Technologies: Octopus Deploy Octopus Server. Vendors: Octopus Deploy.

Quick answers

Is CVE-2026-118426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118426 being exploited in the wild.
How severe is CVE-2026-118426?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Octopus Deploy Octopus Server All 3.x.x, 4.x.x; 2018.x through 2022.x; 2023.x, 2024.x, 2025.x, 2026.1.x; 2026.2.x before 2026.2.13487; 2026.3.x before 2026.3.15909.
Is there a fix for CVE-2026-118426?: Yes: fixed in Octopus Server 2026.2.13487, 2026.3.15909 or higher. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118426 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-118426?: Check whether you run Octopus Deploy Octopus Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Octopus Server 2026.2.13487, 2026.3.15909 or higher

Technical details

A missing authorization vulnerability in Octopus Server allows authenticated users to call LDAP user search and group search endpoints without proper access controls when LDAP authentication is configured. This enables directory enumeration and information disclosure about the organization's directory structure. Authentication to Octopus Server is required to exploit this flaw.

Affected products

Octopus Deploy Octopus Server All 3.x.x, 4.x.x; 2018.x through 2022.x; 2023.x, 2024.x, 2025.x, 2026.1.x; 2026.2.x before 2026.2.13487; 2026.3.x before 2026.3.15909

Timeline

2026-10-28: disclosed
2026-10-09: patched

References

https://advisories.octopus.com/post/2026/sa2026-18

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.