CVE-2026-0704: 
Octopus Deploy vulnerability analysis and mitigation

CVE-2026-0704 is a path traversal vulnerability in Octopus Deploy (Octopus Server) that allows an attacker to remove files and/or overwrite file contents on the host system via an insufficiently validated API endpoint. The vulnerability was published on February 25, 2026, and affects Octopus Server versions from 2023.1.4189 up to (excluding) 2025.3.14715, as well as versions 2025.4.0 through 2025.4.10358. It carries a CVSS v3.1 base score of 9.1 (Critical) as assessed by NIST, while the CNA (Octopus Deploy) assigned a CVSS v4.0 base score of 5.9 (Medium) (Octopus Advisory, Feedly).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), added by CISA-ADP to the CVE record. An API endpoint in Octopus Server lacked proper input validation on a field that influences file system operations, enabling an attacker to traverse directory boundaries and target arbitrary files on the host. This could allow deletion of files or truncation/overwriting of file contents outside the intended application directory. Related attack patterns include CAPEC-126 (Path Traversal), CAPEC-64 (Using Slashes and URL Encoding to Bypass Validation), and CAPEC-76 (Manipulating Web Input to File System Calls) (Octopus Advisory, Feedly).

Successful exploitation can result in deletion of critical files or corruption of file contents on the Octopus Server host, impacting both integrity and availability of the system. Attackers could destroy deployment configurations, disrupt CI/CD workflows, or render the server inoperable. While confidentiality is not directly impacted (no data exfiltration vector is described), the ability to manipulate deployment pipelines could facilitate indirect compromise of downstream systems managed by Octopus Deploy (Octopus Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify internet-facing Octopus Server instances running versions between 2023.1.4189 and 2025.3.14714 (or 2025.4.0–2025.4.10358) using network scanning tools or Shodan queries targeting Octopus Deploy's default ports and web interface.
2. Identify vulnerable API endpoint: Locate the specific API endpoint that accepts a field influencing file system paths, based on Octopus Deploy's API documentation or by observing application traffic.
3. Craft path traversal payload: Construct a request with a malicious field value containing path traversal sequences (e.g., ../../, URL-encoded variants such as %2e%2e%2f, or alternate encodings) to escape the intended directory scope.
4. Submit malicious request: Send the crafted API request to the vulnerable endpoint, targeting critical files (e.g., configuration files, deployment scripts, or OS files) for deletion or content overwriting.
5. Achieve objective: Confirm file deletion or modification on the host, potentially disrupting deployment workflows or causing system instability (Octopus Advisory, Feedly).

• Network: Unusual or malformed API requests to Octopus Server endpoints containing path traversal sequences (../, %2e%2e%2f, %252e%252e%252f) in field values; unexpected API calls from unfamiliar source IPs.
• Logs: Octopus Server access logs showing API requests with encoded or raw path traversal strings in request parameters; error messages related to file not found or permission denied for files outside expected directories.
• File System: Missing or unexpectedly emptied configuration files, deployment scripts, or system files on the Octopus Server host; timestamps on critical files inconsistent with normal operations.
• Process: Unexpected file deletion or modification events recorded by file integrity monitoring tools on the Octopus Server host.

Octopus Deploy has released patched versions addressing this vulnerability: upgrade Octopus Server from versions 2023.1.4189–2025.3.14714 to 2025.3.14715 or later, and from versions 2025.4.0–2025.4.10358 to 2025.4.10359 or later. As an interim workaround, restrict network access to Octopus Deploy API endpoints using firewall rules or network segmentation until patching can be completed. Monitor affected systems for suspicious file deletion or modification activity. Full patch details are available in the vendor advisory (Octopus Advisory).

Coverage of CVE-2026-0704 has been limited to automated vulnerability tracking platforms and aggregators such as VulnDB, CIRCL, and INCIBE-CERT, with no notable independent researcher commentary or significant social media discussion identified. A brief mention appeared in the Straylight Sentinel security brief on February 27, 2026. The overall community response has been muted, consistent with the absence of public exploit code or active exploitation (Feedly).