CVE-2026-0704 — Octopus Deploy / Octopus Server

CVE-2026-0704

Octopus Deploy / Octopus Server PUBLISHED

Description (CNA)

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.

Affected (CNA)

Vendor / product	Versions
Octopus Deploy / Octopus Server	affected 2023.0.0 before 2025.3.14715; affected 2025.4.0 before 2025.4.10359

CWE

No CWE identifiers supplied.

References

https://advisories.octopus.com/post/2026/sa2026-01

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.