Delinea Secret Server On-Prem vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Delinea Secret Server On-Prem: 5 record(s), with affected versions and fixes.

CVE-2026-15640 Critical · 9.5 CWE-290 Sep 15, 2026

Authentication Bypass via SAML Response Manipulation

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

CVE-2026-15639 Critical · 9.3 CWE-79 Sep 15, 2026

Reflected Cross-Site Scripting

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

CVE-2026-15638 Critical · 9.1 CWE-327 Sep 15, 2026

Cryptographic Padding Oracle

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.

CVE-2026-19117 Critical · 9.8 CWE-290 Sep 2, 2026

Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

CVE-2025-12810 Medium · 6.5 CWE-287 Jan 27, 2026

Failure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of Credentials

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reaching its retry limit. This leaves the secret in an inconsistent state with the wrong password. Remediation: Upgrade to 11.9.47 or later. The secret will remain checked out when the password change fails.