Vulnerabilidades do Delinea Secret Server On-Prem

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Delinea Secret Server On-Prem: 5 registro(s), com versões afetadas e correções.

CVE-2026-15640 Crítica · 9.5 CWE-290 15/09/2026

Authentication Bypass via SAML Response Manipulation

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

CVE-2026-15639 Crítica · 9.3 CWE-79 15/09/2026

Reflected Cross-Site Scripting

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

CVE-2026-15638 Crítica · 9.1 CWE-327 15/09/2026

Cryptographic Padding Oracle

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.

CVE-2026-19117 Crítica · 9.8 CWE-290 02/09/2026

Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

CVE-2025-12810 Média · 6.5 CWE-287 27/01/2026

Failure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of Credentials

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reaching its retry limit. This leaves the secret in an inconsistent state with the wrong password. Remediation: Upgrade to 11.9.47 or later. The secret will remain checked out when the password change fails.