VulnSocial

CVE-2026-91778Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allow the script to execute without the user possessing the required authorisation.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-17: 1Technical Details · 2026-09-17: 109-17
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • CCB Alert@CCBalert
    Disclosure

    Warning: High-severity flaws in #OctopusDeploy #Octopus Server! #CVE-2026-92355 (CVSS 8.7) allows arbitrary file overwrite via path traversal leading to #RCE, while CVE-2026-91778 (CVSS 7.2) allows unauthorized arbitrary script execution on workers. Time to #Patch #Patch #Patch

    Post summary

    The tweet discloses two high-severity vulnerabilities in Octopus Deploy (CVE-2026-92355 and CVE-2026-91778) with CVSS scores and technical descriptions, urging users to patch via hashtags.

    01000272
    7.3K followersView on X

Explore more

Back to dashboard