CVE-2026-15638: Delinea Secret Server On-Prem

Critical severity, CVSS 9.1. EPSS: 0.2% chance of exploitation in the next 30 days.

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.

Affected products

• Delinea Secret Server On-Prem: from 10.5.1, up to and including 12.1.3

Published 2026-09-16. Last modified 2026-09-18.