CVE-2021-26556: Octopus Deploy

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.

Affected products

• Octopus Octopus Deploy: from 0.9, before 2020.4.229 (fixed in 2020.4.229)
• Octopus Octopus Server: from 2020.5.0, before 2020.5.256 (fixed in 2020.5.256)

Published 2021-10-07. Last modified 2026-06-17.