Description
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Published: 2026-09-15
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized decryption or forging of data using the server’s cryptographic keys, compromising confidentiality.
Action: Patch Immediately
AI Analysis

Impact

Deliena Secret Server (On‑Prem) contains a padding oracle that enables an unauthenticated user to trigger decryption or encryption with the server’s cryptographic keys. The flaw does not expose the key itself; instead, repeated oracle responses allow recovery of encrypted data or creation of valid ciphertext. This jeopardizes the confidentiality of stored secrets and credentials.

Affected Systems

The affected product is Delinea Secret Server (On‑Prem). The CNA recommends upgrading to version 12.2.7 or later to eliminate the issue. No further version range is specified in the advisory.

Risk and Exploitability

The CVSS score of 9.1 marks the vulnerability as critical. The EPSS score of <1 % indicates that exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. The attack vector is an unauthenticated endpoint; an attacker with network access can send crafted requests to elicit oracle responses and gradually reconstruct encrypted information or forge ciphertext, all without needing prior credentials.

Generated by OpenCVE AI on September 16, 2026 at 18:04 UTC.

Remediation

Vendor Solution

Upgrade to secret server version 12.2.7 or later.

OpenCVE Recommended Actions

  • Upgrade to Secret Server version 12.2.7 or later.
  • Disable or enforce authentication for all cryptographic operations to eliminate unauthenticated access.
  • Restrict network access to the Secret Server to trusted hosts or subnets and monitor logs for anomalous decryption attempts.

Generated by OpenCVE AI on September 16, 2026 at 18:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://delinea.com/security-advisories cve-icon cve-icon
History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Title Cryptographic Padding Oracle
Weaknesses CWE-327
References
Metrics cvssV4_0

{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Delinea

Published:

Updated: 2026-09-16T19:36:54.361Z

Reserved: 2026-07-13T18:18:20.775Z

Link: CVE-2026-15638

cve-icon Vulnrichment

Updated: 2026-09-16T19:36:46.871Z

cve-icon NVD

Status : Received

Published: 2026-09-16T00:17:02.600

Modified: 2026-09-16T20:17:20.950

Link: CVE-2026-15638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T18:15:15Z

Weaknesses
  • CWE-327

    Use of a Broken or Risky Cryptographic Algorithm