Search threats, CVEs… ⌘K
Back to vendor advisories
Delinea Security AdvisoriesCVE-2025-12811

Delinea Cloud Suite and Privileged Access Service - HTTP Request Smuggling vulnerability - CVE-2025-12811

MediumVendor CVSS 6.9 / 10 1 CVE Published Feb 12, 2026 at 12:00 AM UTC
Get alerts for Cloud Suite and Privileged Access Service

Summary

Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service.

If you're not using the latest Server Suite agents, this fix requires that you upgrade to Server Suite 2023.1 (agent 6.0.1) or later. If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions: Server Suite release 2023.0.5 (agent version 6.0.0-158), or Server Suite release 2022.1.10 (agent version 5.9.1-337).

Products covered

  • Delinea Cloud Suite and Privileged Access Service version 25.1 HF4 and earlier

Remediation

Vendor-listed fixes

  • Upgrade to version 25.1 HF5 or later

CVEs in this advisory 1

CVE-2025-12811
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Severity changed from Low to Medium.
    • CVSS changed from 3.8 to 6.9.
    • Added CVEs: CVE-2025-12811.
    • Removed CVEs: CVE-2025-6942.
    • Added affected products: Delinea Cloud Suite and Privileged Access Service version 25.1 HF4 and earlier.
    • Removed affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later.
    • Added fixed versions: Upgrade to version 25.1 HF5 or later.
    • Removed fixed versions: Upgrade to Secret Server version 11.7.60 or later.
    • The vendor changed its remediation guidance.
    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Severity changed from Critical to Low.
    • CVSS changed from 9.8 to 3.8.
    • Added CVEs: CVE-2025-6942.
    • Removed CVEs: CVE-2026-19117.
    • Added affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later.
    • Removed affected products: Delinea Secret Server on-prem 10.6.0 through 11.7.61 11.8.0 through 11.8.1 11.9.0 through 11.9.47 12.0.0 through 12.0.22 12.1.0 through 12.1.2 Resolution:Upgrade to secret server version 12.2.7 or later, or upgrade to....
    • Added fixed versions: Upgrade to Secret Server version 11.7.60 or later.
    • Removed fixed versions: Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.Customers on versions prior to 11.7 should upgrade to a supported version to....
    • The vendor changed its remediation guidance.

Updates

  1. Published by Delinea

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor