XSS in Octopus Deploy Server

CVE-2026-8296

In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (24.0th percentile) — read the EPSS interpretation.