CVE-2022-4009: Octopus Server

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation

Affected products

• Octopus Octopus Server: from 3.0.19, before 2022.2.8552 (fixed in 2022.2.8552); from 2022.3.348, before 2022.3.10750 (fixed in 2022.3.10750); from 2022.4.791, before 2022.4.8319 (fixed in 2022.4.8319)

Published 2023-03-16. Last modified 2026-06-17.