CVE-2026-15639 – Delinea Secret Server (On-Prem)

CVSS 9.3 CRITICAL [2] Critical – Same Day Deployment

“When the vault that guards every credential can be tricked into trusting a stranger, every secret inside belongs to the attacker”

This update fixes three Critical vulnerabilities in Delinea Secret Server (On-Prem), the system many organizations use to store their most privileged credentials. CVE-2026-15640 has a CVSS score of 9.5, Critical severity. Under certain conditions, a valid SAML identity provider response can be used to impersonate another Secret Server user, which lets an attacker gain that user's privileges. CVE-2026-15639 has a CVSS score of 9.3, Critical severity. It is a cross-site scripting flaw: a crafted link runs attacker-supplied JavaScript in the browser of any legitimate user who opens it.

CVE-2026-15638 has a CVSS score of 9.1, Critical severity. An unauthenticated attacker with access to Secret Server can use a padding oracle to decrypt or encrypt data with one of the server's cryptographic keys, although the key itself is not exposed. Together, these flaws threaten the confidentiality of stored secrets and the integrity of user identities. Apply this patch the same day.

Key Details

CWE Classification: CWE-79

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.