Octopus Server: Privilege escalation from System Manager to Administrator
Summary
Octopus Server contains a flaw in privilege management that allows a user with the System Manager role to escalate their privileges to full system Administrator. An attacker needs a valid account with the System Manager role and network access to the server. Successful exploitation gives full control over the Octopus instance, which typically holds credentials for and deploys to many production systems.
Affected
- Octopus Server 2019.0.0 to before 2026.2.13469
- Octopus Server 2026.3.0 to before 2026.3.15863
- Octopus Cloud instances have already been updated.
Fixed in
- Octopus Server 2026.2.13469 (for 2026.2.x and earlier feature versions as listed by the vendor)
- Octopus Server 2026.3.15863 (for 2026.3.x)
- The vendor recommends the latest release, 2026.3.15937.
Workaround
- None known. The vendor states there is no known mitigation.
- Interim measure (not from the vendor): review who holds the System Manager role and remove it where it is not needed until the upgrade is complete.
Exploitation
- The vendor is not aware of any public announcements or malicious use.
- OffSeq reports the vulnerability as not known to be exploited; Strix lists it as not in KEV.
- No public proof of concept found in the sources reviewed.
- The CISA KEV status was not directly verified.
Our recommendation
- Inventory all Octopus Server instances and their versions, on Linux and Windows.
- Upgrade to the fixed builds (2026.2.13469 or 2026.3.15863, or the latest 2026.3.15937) in a maintenance window, with priority for internet-facing instances.
- Review and reduce accounts with the System Manager role until the upgrade is complete.
- Check whether CVE-2026-102478 (SA2026-11) is also addressed by the chosen build.
- Monitor for unexpected role changes and new administrator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Octopus Deploy Security Advisory 2026-17 advisories.octopus.com
- VulDB entry 427139 vuldb.com
- CVE record aggregator (threatint) cve.threatint.com
- OffSeq threat radar entry radar.offseq.com
- Strix CVE entry www.strix.ai
- VulDB entry for related CVE-2026-102478 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:02.
Original description (NVD)
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.