CVE-2026-0704

Critical · 9.1

CVSS

9.1

EPSS

0.3%

Published

Feb 25, 2026

CISA due date

—

The record

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows.

Affected packages

Ecosystem	Package	Introduced	Fixed