Loading story…
Octopus Deploy disclosed CVE-2026-101169, a high-severity insecure JSON deserialization vulnerability that enables authenticated users with permission to edit an Environment or Project to execute arbitrary code in the Octopus Server process. The issue affects Octopus Server deployments on Linux and Windows, including versions from 2019.4.x through 2025.x and vulnerable builds in the 2026.1 through 2026.4 feature branches.
The vendor released patches on September 14 and published Security Advisory 2026-10 on September 29. No workaround or mitigation is available other than upgrading affected self-hosted instances; Octopus Deploy recommends immediate patching. The company reported no known public exploitation at disclosure, while stating that Octopus Cloud environments had already been remediated and require no customer action.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Octopus Deploy publicly disclosed CVE-2026-101169 through Security Advisory 2026-10, advising affected Linux and Windows Octopus Server users to upgrade because no alternative mitigation was available. It reported no known public exploitation or malicious use at disclosure.
Octopus Deploy released fixed Octopus Server versions for CVE-2026-101169. The flaw could allow authenticated users permitted to edit Environment or Project objects to execute code in the Octopus Server process.
Nathan Willoughby of Octopus Deploy identified CVE-2026-101169, an insecure JSON deserialization flaw in Octopus Server, during internal testing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026
Microsoft disclosed and patched **CVE-2026-58644**, a critical remote code execution flaw in **Microsoft SharePoint** caused by insecure deserialization of untrusted data (`CWE-502`). The vulnerability carries a **CVSS 9.8** rating and allows an **unauthorized attacker** to execute arbitrary code over the network by sending a crafted HTTP request, with **no user interaction required**. Affected products include **SharePoint Enterprise Server 2016**, **SharePoint Server 2019**, and **SharePoint Server Subscription Edition** prior to patched versions published through Microsoft's security guidance. Reporting on the release said no active exploitation had been confirmed at disclosure, but warned that exploitation is likely because SharePoint is widely deployed in enterprises; organizations were urged to prioritize patching internet-exposed SharePoint systems, review access permissions, and monitor server logs for suspicious activity.
Aug 15, 2026
Dell Technologies disclosed multiple vulnerabilities in **ObjectScale** and **Elastic Cloud Storage (ECS)** through advisory **DSA-2026-393**. The most severe, **CVE-2026-70416**, carries a CVSS score of 10.0 and allows unauthenticated remote code execution through unsafe deserialization of untrusted data in ObjectScale versions earlier than `4.4.0.0`, potentially enabling remote compromise of affected storage systems. The advisory also covers an unauthenticated improper-authentication flaw, local privilege-management and cryptographic weaknesses, an operating-system permission issue that can cause denial of service, and third-party component vulnerabilities. Dell advises organizations to upgrade to **ObjectScale/ECS 4.4.0.0 or later**; `4.2.0.1` is also available for supported affected releases. Until patching is complete, administrators should restrict management interfaces to trusted networks and monitor authentication and configuration activity for signs of abuse.
Sep 18, 2026