Delinea Secret Server CVE-2026-115829

Exploitation requires a Secret Server deployment configured with two-factor/second-factor authentication, because the bypass works by completing only the second-factor login step while skipping the initial (primary credential) step; without MFA configured there is no second step to negotiate in isolation. The attacker must be able to satisfy that second factor, which aligns with the vendor's PR:H and is the main limiting factor, together with AC:H indicating the flow manipulation is not trivial. The available sources do not describe exactly how the primary step is skipped, so the precise trigger is not described in the available sources. The only complete remediation stated by the vendor is upgrading to Secret Server 12.3.1 or later.

The vendor-assigned CVSS 4.0 base score of 8.7 (High) is driven primarily by impact rather than ease of attack: VC:H/VI:H plus subsequent-system impact (SC:H/SI:H) reflect that Secret Server is a privileged-access/secrets-management product whose compromise cascades to the credentials it protects. However, the attack is throttled by AC:H (non-trivial) and PR:H (the attacker already needs significant privileges or a valid authentication factor), which is an important tension: the finding is literally an authentication bypass (CWE-288), yet the vector assigns PR:H rather than PR:N, indicating the attacker must still be able to negotiate the second-factor step and is not a fully anonymous outsider. No EPSS score, no CISA KEV listing, and no proof-of-concept were provided, so there is currently no public exploit identified at time of analysis and no quantitative exploitation-probability signal. The vuln.today decision label is 'this_week', consistent with a serious authentication-control flaw in a security product that warrants prompt patching but is not flagged for emergency/act_now handling. Net assessment: a genuinely meaningful weakness because of the product class and the authentication-control impact, but real-world risk is tempered by the AC:H/PR:H prerequisites and the absence of any evidence of exploitation or exploit code.

An attacker who can drive Secret Server's login flow and satisfy the second-factor (MFA) step completes authentication without ever passing the primary username/password step, landing in an authenticated session. No public exploit code was provided, so this is a hypothesis grounded in the description rather than an observed technique; the AC:H rating indicates the bypass is not a simple, reliably repeatable request.