CVE-2026-15639: Delinea Secret Server On-Prem

Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days.

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

Affected products

• Delinea Secret Server On-Prem: from 10.2.19, up to and including 11.9.48

Published 2026-09-16. Last modified 2026-09-18.