CVE-2026-15638
9.1
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H
Summary
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Delinea | Secret Server (On-Prem) | 10.5.1 <= 12.1.3 | affected |
Weaknesses
- CWE-327: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.