Delinea
Monthly
Authentication bypass in Delinea Secret Server before 12.3.1 lets a user skip the primary login step and authenticate by completing only the second-factor login step when two-factor authentication is configured. The vendor rates it 8.7 High; exploitation requires the attacker to be able to satisfy the second factor and is assessed as high complexity, so it is not a trivial unauthenticated bypass. No public exploit code or active-exploitation confirmation was identified in the available sources at time of analysis.
Delinea Secret Server versions earlier than 12.3.1 can return cloudadmin permissions to a user who submits an unsigned JWT under conditions not enumerated in the available sources, creating an authorization-bypass and privilege-escalation risk in a privileged access management product. The issue is network-reachable but rated high complexity and requires an existing privileged/authenticated context (CVSS PR:H), and it is remediated in 12.3.1. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied data.
Arbitrary code execution as LocalSystem is possible through the privilege manager agent in Delinea Privilege Manager builds 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058, rooted in missing authentication for a critical function (CWE-306). The severity picture is genuinely contested: the vendor CVSS 4.0 vector scores 8.7 but requires high privileges (PR:H), active user interaction (UI:A), elevated attack complexity (AC:H) and specific attack requirements (AT:P), while our assessed CVSS 3.1 vector treats the same flaw as unauthenticated (PR:N) network-reachable with high confidentiality, integrity and availability impact. Because the exact trigger is not described in the available sources, defenders cannot yet confirm whether default deployments are exposed; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the vuln.today decision label places remediation in this week's work.
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to craft a malicious link that, when clicked by a legitimate Secret Server user, causes the browser to execute attacker-supplied JavaScript in the context of the Secret Server web application. The attacker requires no authentication (PR:N per the CVSS 4.0 vector), but exploitation is not self-contained: a human victim must be lured into clicking the link (UI:A), and the practical impact scales with the victim's privileges - a privileged vault user's session and access could be abused to read or modify secrets, producing high confidentiality and integrity impact on both the vulnerable system and subsequent systems (VC:H/VI:H, SC:H/SI:H, S:C). CVSS 4.0 base score is 9.3 (Critical) and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis, and note that only on-premises deployments in the stated version range are affected - SaaS/cloud instances are not listed as affected.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'
Delinea Secret Server before 12.3.1 can accept a FIDO2 authenticator's possession factor without reliably enforcing the PIN or biometric user-verification step, weakening the assurance expected from that second factor for authenticated users. The issue is a moderate-severity CWE-284 improper access-control weakness affecting deployments that use FIDO2 authentication; the assessed vector includes PR:H, so exploitation presupposes a privileged or authenticated context, or access to a registered FIDO2 device, rather than a fully unauthenticated remote bypass. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. [CVSS 6.5 MEDIUM]
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication bypass in Delinea Secret Server before 12.3.1 lets a user skip the primary login step and authenticate by completing only the second-factor login step when two-factor authentication is configured. The vendor rates it 8.7 High; exploitation requires the attacker to be able to satisfy the second factor and is assessed as high complexity, so it is not a trivial unauthenticated bypass. No public exploit code or active-exploitation confirmation was identified in the available sources at time of analysis.
Delinea Secret Server versions earlier than 12.3.1 can return cloudadmin permissions to a user who submits an unsigned JWT under conditions not enumerated in the available sources, creating an authorization-bypass and privilege-escalation risk in a privileged access management product. The issue is network-reachable but rated high complexity and requires an existing privileged/authenticated context (CVSS PR:H), and it is remediated in 12.3.1. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied data.
Arbitrary code execution as LocalSystem is possible through the privilege manager agent in Delinea Privilege Manager builds 10.1.0 through 12.0.5796 and 13.0.0 through 13.0.1058, rooted in missing authentication for a critical function (CWE-306). The severity picture is genuinely contested: the vendor CVSS 4.0 vector scores 8.7 but requires high privileges (PR:H), active user interaction (UI:A), elevated attack complexity (AC:H) and specific attack requirements (AT:P), while our assessed CVSS 3.1 vector treats the same flaw as unauthenticated (PR:N) network-reachable with high confidentiality, integrity and availability impact. Because the exact trigger is not described in the available sources, defenders cannot yet confirm whether default deployments are exposed; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though the vuln.today decision label places remediation in this week's work.
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to craft a malicious link that, when clicked by a legitimate Secret Server user, causes the browser to execute attacker-supplied JavaScript in the context of the Secret Server web application. The attacker requires no authentication (PR:N per the CVSS 4.0 vector), but exploitation is not self-contained: a human victim must be lured into clicking the link (UI:A), and the practical impact scales with the victim's privileges - a privileged vault user's session and access could be abused to read or modify secrets, producing high confidentiality and integrity impact on both the vulnerable system and subsequent systems (VC:H/VI:H, SC:H/SI:H, S:C). CVSS 4.0 base score is 9.3 (Critical) and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis, and note that only on-premises deployments in the stated version range are affected - SaaS/cloud instances are not listed as affected.
A padding oracle in on-premises Delinea Secret Server (versions 10.5.1 through 12.1.3) allows unauthenticated remote attackers to decrypt or forge data protected with one of the server's own cryptographic keys, although the key material itself is never exposed. Exploitation is not trivial: it is an adaptive chosen-ciphertext attack that requires many crafted requests and a distinguishable padding-validation response from an exposed cryptographic operation, which is why the vendor scores it 9.1 Critical (CVSS 4.0) while the assessed vector (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) reflects high complexity and only partial integrity loss on the vulnerable component. EPSS is low at 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; the elevated overall severity comes from the key's role protecting data across subsequent systems (SC:H/SI:H/SA:H), not from a single-request or trivially reproducible attack.
Authentication bypass in on-premises Delinea Secret Server allows an attacker to register an attacker-controlled FIDO2 credential against a victim's account and subsequently log in as that user (CWE-290, spoofing). Because Secret Server is a privileged-access-management vault, a successful bypass yields access to whatever secrets and privileges the impersonated account holds. No public exploit identified at time of analysis and no CISA KEV listing; the vendor rates it CVSS 9.8, though the description qualifies exploitation as occurring only 'under specific conditions.'
Delinea Secret Server before 12.3.1 can accept a FIDO2 authenticator's possession factor without reliably enforcing the PIN or biometric user-verification step, weakening the assurance expected from that second factor for authenticated users. The issue is a moderate-severity CWE-284 improper access-control weakness affecting deployments that use FIDO2 authentication; the assessed vector includes PR:H, so exploitation presupposes a privileged or authenticated context, or access to a registered FIDO2 device, rather than a fully unauthenticated remote bypass. No public exploit was identified at time of analysis, and no CISA KEV confirmation is present.
Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. [CVSS 6.5 MEDIUM]
Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in Delinea Centrify PAS v. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key,. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
File accessibility vulnerability in Delinea Secret Server, in its v10.9.000002 and v11.4.000002 versions. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.