by Kastro
Paper/Archive/CVE-2026-115828

CVE-2026-115828

Delinea Secret Server (On-Prem) — Secret Server device validation error

EPSS 0.4%CVSS 9.4
critical.is priorityof 100
34
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 29.8.298 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device

Affected

ProductAffectedFixed inSource
Secret Server (On-Prem)older versions – 12.2.7–CNA

Scores by source

Delinea (CNA)9.4CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refdelinea.com/security-advisories