CVE-2026-0704

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint

Medium · published February 25, 2026

CVSS v4.0
5.9
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00345 · 26.9th percentile
Published
2026-02-25T12:22Z
EPSS history
Timeline
  • 25 FEB 12:22Z
    In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint
    cvelistv5