CVE-2026-115829High· 8.7▾ TwilightIn Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
secret_server >= older versions <= 12.2.7Upgrade to Secret Server version 12.3.1
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115828Medium· 5.1Secret Server device validation error
CVE-2026-115830High· 8.7Secret Server JWT issuance error
CVE-2026-92744High· 8.7Delinea Privilege Manager agent unauthenticated remote code execution vulnerability
CVE-2026-15638Critical· 9.1An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys
CVE-2026-15640Critical· 9.5Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
CVE-2026-15639Critical· 9.3An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.