CVE-2026-92744High· 8.7▾ MidnightPoC availableUnder certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
1 GitHub repo (last check)
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
privilege_manager >= 10.1.0 <= 12.0.5796privilege_manager >= 13.0.0 <= 13.0.1058Upgrade to privilege manager version 13.0.2064 if you're using windows agent above 12.0.5796
Upgrade to privilege manager version 12.0.5804 if you're using windows agent 12.0.5796 or less
For cloud customers and on-prem customers that are unable to upgrade, please see release notes for the steps you can take to mitigate the issue.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115828Critical· 9.4Secret Server device validation error
CVE-2026-115830High· 8.7Secret Server JWT issuance error
CVE-2026-115829Critical· 9.9Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
CVE-2026-15638Critical· 9.1An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys
CVE-2026-15640Critical· 9.5Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
CVE-2026-15639Critical· 9.3An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.