Paper/Archive/CVE-2026-115829

CVE-2026-115829

Delinea Secret Server (On-Prem) — Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

EPSS 0.3%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 24.3.243 × 204.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.

Affected

ProductAffectedFixed inSource

Secret Server (On-Prem)older versions – 12.2.7–CNA

Scores by source

Delinea (CNA)9.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdelinea.com/security-advisories