Delinea
Vulnerability activity for Delinea: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 3
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.7HighOct 30, 2026Delinea Secret Server Auth bypass / access controlCVE-2026-115830In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
- 8.7HighOct 30, 2026Delinea Secret Server Auth bypass / access controlCVE-2026-115829In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- 5.1MediumOct 30, 2026Delinea Secret Server Auth bypass / access controlCVE-2026-115828In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
- 8.7HighOct 29, 2026Delinea Privilege Manager Crypto / certificateCVE-2026-92744Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.Exploit code
- 9.5CriticalSep 16, 2026Delinea Secret Server (On-Prem) Auth bypass / access controlCVE-2026-15640Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
- 9.3CriticalSep 16, 2026Delinea Secret Server (On-Prem) XSSCVE-2026-15639An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.
- 9.1CriticalSep 16, 2026Delinea Secret Server (On-Prem) Crypto / certificateCVE-2026-15638An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
- 6.5MediumJan 27, 2026Delinea secret server Auth bypass / access controlCVE-2025-12810Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reaching its retry limit. This leaves the secret in an inconsistent state with the wrong password. Remediation: Upgrade to 11.9.47 or later. The secret will remain checked out when the password change fai
Top products
- Secret Server4 CVEs in the last year
- Secret Server (On-Prem)3 CVEs in the last year, 3 critical
- Privilege Manager1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.