CVE-2026-8296 is a stored XSS vulnerability in Octopus Deploy's Octopus Server that allows an attacker with certain access privileges to embed a cross-site scripting payload through artifacts. This vulnerability affects versions 2023.0.0, 2026.1.0, and 2026.2.0 of the product. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges required but user interaction needed, and high impact on confidentiality and integrity. The vendor has not provided an official fix or remediation level as of the publication date.

Successful exploitation could allow an attacker with appropriate access to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, unauthorized actions, or data exposure within the affected Octopus Server environment. However, exploitation requires certain access levels and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Octopus Server artifacts to trusted users only and apply the principle of least privilege to limit exposure. Monitor vendor communications for updates on patches or official mitigations.