In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-12887 · Microsoft / collected KEV context

cve-program · CVE-2026-12887

• https://advisories.octopus.com/post/2026/sa2026-14/

• In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a script step so the script executes outside of the parent directory. · Newly collected advisory · 27 Oct 2026