CVE-2022-2778

CRITICAL 9.8CVE-2022-2778 · Published 30/09/2022 · updated 17/06/2026

In short

CVE-2022-2778 is a CRITICAL (CVSS 9.8) vulnerability affecting octopus server (octopus).
Chance of exploitation in the next 30 days (EPSS): 0.85%, higher than 58.3% of all vulnerabilities.
Fix: update to 2022.3.10405, 2022.4.1371, 2022.2.8277 or later.

Package	Affected versions	Patched versions
octopus server octopus	`≥ 2022.3.348, < 2022.3.10405≥ 2022.4.791, < 2022.4.1371≥ 3.0, < 2022.2.8277`	`2022.3.104052022.4.13712022.2.8277`

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 2022.3.348, < 2022.3.10405≥ 2022.4.791, < 2022.4.1371≥ 3.0, < 2022.2.8277

2022.3.104052022.4.13712022.2.8277

More vulnerabilities in octopus server

See all →