CVE-2026-115828Critical· 9.4▾ MidnightIn Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
5.1 → 9.4
medium → critical
In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
secret_server_on-prem >= older versions <= 12.2.7Upgrade to Secret Server on-prem version 12.3.1
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115829Critical· 9.9Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
CVE-2026-115830High· 8.7Secret Server JWT issuance error
CVE-2026-15638Critical· 9.1An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys
CVE-2026-15639Critical· 9.3An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.
CVE-2026-15640Critical· 9.5Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
CVE-2026-92744High· 8.7Delinea Privilege Manager agent unauthenticated remote code execution vulnerability