Search threats, CVEs… ⌘K
Back to vendor advisories
Delinea Security AdvisoriesCVE-2026-15640

Authentication Bypass via SAML Response Manipulation - CVE-2026-15640

CriticalVendor CVSS 9.5 / 10 1 CVE Published Sep 15, 2026 at 12:00 AM UTC
Get alerts for Secret Server on-prem

Summary

No separate summary was provided in the collected bulletin.

Products covered

  • Delinea Secret Server on-prem 10.5.0 through 12.1.3

Remediation

Vendor-listed fixes

  • Upgrade to secret server version 12.2.7 or later.

CVEs in this advisory 1

CVE-2026-15640
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • CVSS changed from 9.8 to 9.5.
    • Added CVEs: CVE-2026-15640.
    • Removed CVEs: CVE-2026-19117.
    • Added affected products: Delinea Secret Server on-prem 10.5.0 through 12.1.3.
    • Removed affected products: Delinea Secret Server on-prem 10.6.0 through 11.7.61 11.8.0 through 11.8.1 11.9.0 through 11.9.47 12.0.0 through 12.0.22 12.1.0 through 12.1.2 Resolution:Upgrade to secret server version 12.2.7 or later, or upgrade to....
    • Added fixed versions: Upgrade to secret server version 12.2.7 or later..
    • Removed fixed versions: Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.Customers on versions prior to 11.7 should upgrade to a supported version to....
    • The vendor changed its remediation guidance.
    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Severity changed from Low to Critical.
    • CVSS changed from 3.8 to 9.8.
    • Added CVEs: CVE-2026-19117.
    • Removed CVEs: CVE-2025-6942.
    • Added affected products: Delinea Secret Server on-prem 10.6.0 through 11.7.61 11.8.0 through 11.8.1 11.9.0 through 11.9.47 12.0.0 through 12.0.22 12.1.0 through 12.1.2 Resolution:Upgrade to secret server version 12.2.7 or later, or upgrade to....
    • Removed affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later.
    • Added fixed versions: Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.Customers on versions prior to 11.7 should upgrade to a supported version to....
    • Removed fixed versions: Upgrade to Secret Server version 11.7.60 or later.
    • The vendor changed its remediation guidance.
    • Added affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later.
    • Removed affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later CVE Details CVE ID: CVE-2025-6942 Published Date: July 2, 2025 Vulnerability Type: Authorization....
    • Added fixed versions: Upgrade to Secret Server version 11.7.60 or later.
    • Removed fixed versions: Upgrade to Secret Server version 11.7.60 or later CVE Details CVE ID: CVE-2025-6942 Published Date: July 2, 2025 Vulnerability Type: Authorization Bypass Through User-Controlled Key CWE: 639 CVSS v3 Score: 3.8 CVSS v3....
    • The vendor changed its remediation guidance.

Updates

  1. Added to SecurityAlert

    We collected the advisory from the official source.

  2. Published by Delinea

    The publication date reported by the vendor.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor