VulnSocial

CVE-2026-92355Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-16); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-16: 1Mentions · 2026-09-17: 1Mentions · 2026-09-30: 1Patch / Workaround · 2026-09-16: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-16: 1Technical Details · 2026-09-17: 1Technical Details · 2026-09-30: 109-1609-1709-30
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-161
Patch1
2026-09-171
Disclosure1
2026-09-301
Patch1
Full discourse3 posts
  • CCB Alert@CCBalert
    Disclosure

    Warning: High-severity flaws in #OctopusDeploy #Octopus Server! #CVE-2026-92355 (CVSS 8.7) allows arbitrary file overwrite via path traversal leading to #RCE, while CVE-2026-91778 (CVSS 7.2) allows unauthorized arbitrary script execution on workers. Time to #Patch #Patch #Patch

    Post summary

    The tweet warns of two high-severity vulnerabilities in Octopus Server, providing CVSS scores and describing their impact (path traversal leading to RCE and arbitrary script execution), but does not mention any PoC, exploit, active exploitation, or specific patch.

    01000272
    7.3K followersView on X
  • The Daily Tech Feed@dailytechonx
    Patch

    Alert: Octopus Server is under a high-severity path traversal vulnerability (CVE-2026-92355). Users with external-feed permissions can overwrite files or even execute remote code. Affected versions span 2024.1 through early 2026.x builds—from 2026.1 up before 2026.1.11725, 2026.2 before 2026.2.13344, and 2026.3 before 2026.3.11816. Linux & Windows versions in scope. The only fix? Upgrade immediately to safe builds. #OctopusServer #CVE2026 #PathTraversal #RemoteCodeExecution #SecurityPatch #HighRisk https://thedailytechfeed.com/critical-octopus-server-vulnerability-lets-low-privileged-users-gain-remote-code-execution/

    Post summary

    The alert discloses a high-severity path traversal vulnerability (CVE-2026-92355) in Octopus Server that can lead to remote code execution, and explicitly instructs users to upgrade to specific patched versions as the sole remediation.

    0000069
    786 followersView on X
  • theenmusketeers@theenmusketeers
    Patch

    if you run octopus server, today's check is cve-2026-92355: 1. inventory self-hosted servers and exact build numbers 2. find who can modify non-built-in external feeds 3. upgrade to 2026.1.11725, 2026.2.13344, or 2026.3.15816 for your branch 4. review recent feed changes and unexpected writes on the server 5. rotate credentials if a writable path held configs, scripts, or secrets a feed editor can traverse paths and overwrite arbitrary files. in some setups, that becomes remote code execution. 'can edit a package feed' is infrastructure access now. https://advisories.octopus.com/post/2026/sa2026-09/

    Post summary

    The tweet discloses CVE-2026-92355 affecting Octopus Server, describing a path traversal vulnerability where a feed editor can overwrite arbitrary files and potentially achieve RCE, and directs users to upgrade to specific patched versions.

    0000039
    237 followersView on X

Explore more

Back to dashboard