Is CVE-2026-92355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92355 being exploited in the wild.

How severe is CVE-2026-92355?

Informational severity, with a CVSS score of 8.7, published 16 September 2026.

Which products and versions are affected?

Octopus Deploy Octopus Server 2024.1.x after 2024.1.4131, 2024.2.x, 2024.3.x, 2024.4.x, all 2025.x, 2026.1.x before 2026.1.11725, 2026.2.x before 2026.2.13344, 2026.3.x before 2026.3.15816.

Is there a fix for CVE-2026-92355?

A patch was published on 2026-08-20: Patch release date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92355 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92355?

Check whether you run Octopus Deploy Octopus Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92355: Octopus Server path traversal in external feeds

CVE-2026-92355 · Severity: info · CVSS 8.7 · Published 2026-09-16

Octopus Server is a continuous deployment platform used to automate software releases across infrastructure. A user with feed management permissions could exploit a path traversal vulnerability to overwrite arbitrary files on the server, potentially leading to unauthorized code execution and complete system compromise in some configurations.

Technologies: Octopus Deploy Octopus Server. Vendors: Octopus Deploy.

Quick answers

Is CVE-2026-92355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92355 being exploited in the wild.
How severe is CVE-2026-92355?: Informational severity, with a CVSS score of 8.7, published 16 September 2026.
Which products and versions are affected?: Octopus Deploy Octopus Server 2024.1.x after 2024.1.4131, 2024.2.x, 2024.3.x, 2024.4.x, all 2025.x, 2026.1.x before 2026.1.11725, 2026.2.x before 2026.2.13344, 2026.3.x before 2026.3.15816.
Is there a fix for CVE-2026-92355?: A patch was published on 2026-08-20: Patch release date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92355 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92355?: Check whether you run Octopus Deploy Octopus Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw (CWE-22) in Octopus Server's non built-in external feed handling logic. A user with permission to modify external feeds can craft a malicious feed path that bypasses directory restrictions and overwrites arbitrary files on the server. The attack requires valid user credentials with feed modification privileges. In environments where Octopus Server runs with elevated privileges or where writable locations contain executable code, this can escalate to remote code execution. Patches are available in versions 2026.1.11725, 2026.2.13344, and 2026.3.15816 or later.

Affected products

Octopus Deploy Octopus Server 2024.1.x after 2024.1.4131, 2024.2.x, 2024.3.x, 2024.4.x, all 2025.x, 2026.1.x before 2026.1.11725, 2026.2.x before 2026.2.13344, 2026.3.x before 2026.3.15816

Timeline

2026-08-16: disclosed: Discovery date during internal testing
2026-08-20: patched: Patch release date
2026-09-16: advisory: Public advisory released

References

https://advisories.octopus.com/post/2026/sa2026-09

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.