The vulnerability allows users who possess certain scoped permission sets to execute arbitrary scripts within an environment without the necessary authorization. This flaw effectively grants them the ability to run any code they choose on the Octopus Server, resulting in remote code execution and full compromise of the affected system.

The flaw affects Octopus Deploy’s Octopus Server product. All currently supported versions of Octopus Server that have not applied the vendor’s patch are vulnerable; specific version numbers were not disclosed in the advisory.

The vulnerability carries a CVSS score of 7.1, indicating a high severity level. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Because the exploitation requires a user with a scoped permission set, an attacker would need authenticated access to the Octopus Server with those permissions, but once that is achieved, arbitrary scripts can be launched without further authorization, presenting a serious risk of system compromise.