Delinea Secret Server CVE-2026-15639

Exploitation requires a legitimate Delinea Secret Server (On-Prem, versions 10.2.19 through 11.9.48) user to click an attacker-crafted malicious link (UI:A / user interaction is mandatory) - the attacker itself needs no authentication (PR:N). Meaningful impact depends on the victim being an authenticated, ideally privileged, Secret Server user whose session and vault access the reflected JavaScript can abuse. Limiting factors: no self-contained/automatable exploitation (a human must be lured into clicking), on-prem deployment only, and the affected version range; SaaS/cloud instances are not listed as affected.

CVSS 4.0 base score is 9.3 (Critical), driven by network vector (AV:N), low complexity (AC:L), no attacker privileges (PR:N), and high vulnerable/subsequent-system confidentiality and integrity (VC:H/VI:H, SC:H/SI:H). However, this is a reflected XSS (CWE-79): the vendor vector explicitly encodes UI:A (active user interaction required), meaning a legitimate user must be socially engineered into clicking an attacker-crafted link - this materially lowers real-world exploitability versus a true zero-click pre-auth flaw at the same score. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is not confirmed as actively exploited. The elevated score is heavily influenced by the scope/subsequent-system metrics (SC/SI:H) and by the sensitivity of the affected product - Delinea Secret Server is a Privileged Access Management (PAM) secrets vault, so JavaScript executing in an authenticated admin's browser could hijack a session and exfiltrate stored privileged credentials. Net: a genuine priority to patch given the product's role, but the UI:A gate and absence of exploitation signals mean it is user-interaction-dependent rather than wormable/mass-exploitable. Note: only a CVSS 4.0 vector was supplied; no 3.1 vector was provided for cross-comparison.

An attacker crafts a malicious URL for a Delinea Secret Server instance embedding attacker-controlled script, then delivers it to a Secret Server user (e.g. an administrator) via phishing email or chat. When the victim clicks the link while authenticated, the reflected XSS executes attacker JavaScript in the victim's browser session, allowing session/token theft or actions against the secrets vault as that user. No public proof-of-concept exploit is currently identified.