Snapshot 226508
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security Advisories
This page provides timely updates on software vulnerabilities, patches, and security-related issues that may impact our products or services. We’re committed to transparency and proactive communication to help you stay informed and protected.
Check back regularly for the latest advisories, mitigation guidance, and best practices to ensure your systems remain secure.
In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
Affected product and version:
Delinea Secret Server on-prem
12.2.7 or earlier
Resolution:
Upgrade to Secret Server on-prem version 12.3.1
CVE Details
CVE ID: CVE-2026-115830
Published Date: October 30, 2026
Vulnerability Type: Incorrect Authorization
CWE: 863
CVSS V4 Score: 8.7
CVSS V4 Vector: AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References: https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-12-3-000001.htm
In Secret Server on-prem versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
Affected product and version:
Delinea Secret Server on-prem
12.2.7 or earlier
Resolution:
Upgrade to Secret Server on-prem version 12.3.1
CVE Details
CVE ID: CVE-2026-115829
Published Date: October 30, 2026
Vulnerability Type: Authentication bypass using an alternate path or channel
CWE: 288
CVSS V4 Score: 9.9
CVSS V4 Vector: /AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References: https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-12-3-000001.htm
In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
Affected product and version:
Delinea Secret Server on-prem
12.2.7 or earlier
Resolution:
Upgrade to Secret Server on-prem version 12.3.1
CVE Details
CVE ID - CVE-2026-115828
Published Date: October 30, 2026
Vulnerability Type: Improper access control
CWE: 284
CVSS V4 Score: 9.4
CVSS V4 Vector: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
References: https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-12-3-000001.htm
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
Affected product and version:
Delinea Privilege Manager on-prem and cloud
from 10.1.0 through 12.0.5796
from 13.0.0 through 13.0.1058
Resolution:
Upgrade to privilege manager version 13.0.2064 if you're using windows agent above 12.0.5796
Upgrade to privilege manager version 12.0.5804 if you're using windows agent 12.0.5796 or less
For cloud customers and on-prem customers that are unable to upgrade, please see release notes for mitigation steps you can take.
CVE Details
CVE ID - CVE-2026-92744
Published Date: October 29, 2026
Vulnerability Type: Missing Authentication for Critical function
CWE: 306
CVSS V4 Score: 8.7
CVSS V4 Vector: AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Credit: Isuka Sanuj (Reporter), Ishan Nim (Reporter)
References: https://docs.delinea.com/online-help/privilege-manager/release-notes/index.htm
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
Affected product and version:
Delinea Secret Server on-prem
10.5.0 through 12.1.3
Resolution:
Upgrade to secret server version 12.2.7 or later.
CVE Details
CVE ID - CVE-2026-15640
Published Date: September 15, 2026
Vulnerability Type: Authentication bypass by spoofing
CWE: 290
CVSS V4 Score: 9.5
CVSS V4 Vector: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
References: https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-12-2-000007.htm
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.
Affected product and version -
Delinea Secret Server on-prem
10.2.19 through 11.9.48
Resolution -
Upgrade to secret server version 12.0.20 or later.
CVE Details
CVE ID - CVE-2026-15639
Published Date: September 15, 2026
Vulnerability Type: Improper neutralization of input during web page generation
CWE: 79
CVSS V4 Score: 9.3
CVSS V4 Vector: AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
References: https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-12-0-000020.htm
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Affected product and version -
Delinea Secret Server on-prem
10.5.1 through 12.1.3
Resolution -
Upgrade to secret server version 12.2.7 or later.
CVE Details
CVE ID - CVE-2026-15638
Published Date: September 15, 2026
Vulnerability Type: Use of a Broken or Risky Cryptographic Algorithm
CWE: 327
CVSS V4 Score: 9.1
CVSS V4 Vector: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H
References: https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-12-2-000007.htm
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Affected Product and Version:
Delinea Secret Server on-prem
10.6.0 through 11.7.61
11.8.0 through 11.8.1
11.9.0 through 11.9.47
12.0.0 through 12.0.22
12.1.0 through 12.1.2
Resolution:
Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.
Customers on versions prior to 11.7 should upgrade to a supported version to address this vulnerability
CVE Details:
CVE ID - CVE-2026-19117
Published Date: September 2, 2026
Vulnerability Type: Authentication bypass by spoofing
CWE: 290
CVSS V3 Score: 9.8
CVSS V3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References: https://docs.delinea.com/online-help/secret-server/release-notes/ssvr-onprem-rn.htm
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.
Affected Product and Version:
Cloud Suite before 25.2 HF1
Resolution:
Upgrade to Cloud Suite version 25.2 HF1 or later
CVE Details:
CVE ID: CVE-2026-2409
Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE: 89
CVSS v4.0 Score: 9.3
CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Credit: Jess Parker (Reporter), Radu Enachi (Reporter)
References: Release Notes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service.
Affected Product and Version:
Delinea Cloud Suite and Privileged Access Service version 23.1.2 and earlier
Resolution:
Upgrade to Cloud Suite version 25.1 or later
CVE Details:
CVE ID: CVE-2025-12812
Published Date: February 12, 2026
Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE: 89
CVSS v4.0 Score: 5.3 (Medium)
CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Credit: Dawid Dudek (Reporter)
References: trust.delinea.com | Release Notes
Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service.
If you're not using the latest Server Suite agents, this fix requires that you upgrade to Server Suite 2023.1 (agent 6.0.1) or later. If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions: Server Suite release 2023.0.5 (agent version 6.0.0-158), or Server Suite release 2022.1.10 (agent version 5.9.1-337).
Affected Product and Version:
Delinea Cloud Suite and Privileged Access Service version 25.1 HF4 and earlier
Resolution:
Upgrade to version 25.1 HF5 or later
CVE Details:
CVE ID: CVE-2025-12811
Published Date: February 12, 2026
Vulnerability Type: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE: 444
CVSS v4.0 Score: 6.9 (Medium)
CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Credit: Dawid Dudek (Reporter)
References: trust.delinea.com | Release Notes
Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).
This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25.
A secret with "change password on check in" enabled automatically checks in even when the password change fails after reaching its retry limit. This leaves the secret in an inconsistent state with the wrong password.
Affected Product and Version:
Delinea Secret Server on-prem versions 11.8.1, 11.9.6, and 11.9.25
Resolution:
Upgrade to Secret Server version 11.9.47 or later
The secret will remain checked out when the password change fails.
CVE Details:
CVE ID: CVE-2025-12810
Published Date: January 27, 2026
Vulnerability Type: Improper Authentication
CWE: 287
CVSS v4.0 Score: 5.3
CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/AU:Y/R:A
Secret Server version 11.7.49 and earlier allows an administrator to gain access to restricted tables by exploiting a vulnerability in the SQL report creation functionality.
Affected Product and Version
Delinea Secret Server on-prem version 11.7.49 and earlier
Resolution
Upgrade to Secret Server version 11.7.60 or later
CVE Details
CVE ID: CVE-2025-6943
Published Date: July 2, 2025
Vulnerability Type: Improper Privilege Management
CWE: 269
CVSS v3 Score: 3.8
CVSS v3 Vector: AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
The distributed engine of Secret Server version 11.7.49 and earlier allows an attacker to impersonate another distributed engine by exploiting a vulnerability in an initial authorization event.
Affected Product and Version
Delinea Secret Server on-prem version 11.7.49 and earlier
Resolution
Upgrade to Secret Server version 11.7.60 or later
CVE Details
CVE ID: CVE-2025-6942
Published Date: July 2, 2025
Vulnerability Type: Authorization Bypass Through User-Controlled Key
CWE: 639
CVSS v3 Score: 3.8
CVSS v3 Vector: AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Delinea makes no warranties of any kind, whether express, implied, statutory, or otherwise, and specifically, disclaims all warranties of fitness for a particular purpose, merchantability, accuracy of informational content, systems integration, non-infringement, non-interference with enjoyment or otherwise. Under no circumstances shall Delinea be liable for any damages whatsoever including direct, indirect, special, punitive or consequential loss or damage, including loss of profits, loss of business, loss of revenue, loss of or damage to goodwill, or loss of data. The foregoing exclusions will not apply to the extent prohibited by applicable law.