In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can supply specially crafted JSON data. The server deserializes this data insecurely, which allows the user to execute arbitrary code within the Octopus Server process. This capability grants the attacker control over the application environment, enabling complete compromise of the server’s integrity and availability as viewed from the application level.

The vulnerability impacts Octopus Deploy: Octopus Server. No specific version numbers are provided in the advisory, so all iterations that allow editing environments and projects and consume user-supplied JSON are potentially affected. Systems that restrict these edit permissions or are running patched releases are not vulnerable.

The CVSS score of 8.7 classifies the flaw as high severity. The EPSS score is not available, providing no guidance on how frequently attackers exploit it, but the lack of a KEV listing indicates it has not yet been widely used. The likely attack vector is a legitimate, authenticated user with edit rights; if anyone can modify an environment or project, they can leverage the flaw. Because the vulnerability relies on a deserialization bug rather than remote network exposure, it requires an attacker to gain at least the same level of access as a user with edit permissions.