Our takeCERT-Bund reports a security-bypass flaw in Octopus Deploy that a remote authenticated attacker can exploit. Update if you run it.Cyber Resilience desk
Sources (7)
What this means for you — Security leader:If you run Octopus Deploy, review WID-SEC-2026-2357 and apply the vendor fix; a remote authenticated attacker can bypass security controls until patched.
What this means for you — Lean IT orgs:If your team uses Octopus Deploy for releases, update it now. If you do not run it, you can ignore this one.
What this means for you — MSP:Inventory client estates for Octopus Deploy and push the vendor patch; authenticated bypass risk means any exposed instance should be prioritized.
What this means for you — Researcher:CERT-Bund advisory WID-SEC-2026-2357: authenticated remote security-control bypass in Octopus Deploy — track the vendor fix and any public technical detail.