CVE-2022-4009

HIGH 8.8CVE-2022-4009 · Published 16/03/2023 · updated 17/06/2026

In short

CVE-2022-4009 is a HIGH (CVSS 8.8) vulnerability affecting octopus server (octopus).
Chance of exploitation in the next 30 days (EPSS): 0.72%, higher than 54.0% of all vulnerabilities.
Fix: update to 2022.3.10750, 2022.4.8319, 2022.2.8552 or later.

Package	Affected versions	Patched versions
octopus server octopus	`≥ 2022.3.348, < 2022.3.10750≥ 2022.4.791, < 2022.4.8319≥ 3.0.19, < 2022.2.8552`	`2022.3.107502022.4.83192022.2.8552`

In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 2022.3.348, < 2022.3.10750≥ 2022.4.791, < 2022.4.8319≥ 3.0.19, < 2022.2.8552

2022.3.107502022.4.83192022.2.8552

More vulnerabilities in octopus server

See all →