CVE-2026-96414

Quick assessment

Affected

Octopus Deploy Octopus Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在受影响的 Octopus Server 版本中，由于身份验证 Cookie 的完整性保护不足，且对已分配给用户的权限（允许其查看用户或审计事件）存在验证缺陷，可能导致该用户将其权限提升为管理员权限。

CVSS 8.7 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

依赖于未经完整性检查的安全相关输入的混淆或加密

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Octopus Deploy	Octopus Server	2022.1.3143 ~ 2026.2.13487	-

II. Public POCs for CVE-2026-96414

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-96414

请登录查看更多情报信息。

Other References for CVE-2026-96414 (1)

https://advisories.octopus.com/post/2026/sa2026-19

https://www.cve.org/CVERecord?id=CVE-2026-96414

Same Patch Batch · Octopus Deploy · 2026-11-11 · 3 CVEs total

CVE-2026-105948	7.7 HIGH	Octopus Server 身份验证绕过漏洞
CVE-2026-93487	7.1 HIGH	Octopus Server 任意版本权限绕过漏洞

IV. Related Vulnerabilities

Same product: Octopus Server

Same vendor: Octopus Deploy

Same weakness: CWE-649