Search threats, CVEs… ⌘K
Back to vendor advisories
Delinea Security AdvisoriesCVE-2026-2409

Delinea Cloud Suite on-prem argument injection vulnerability - CVE-2026-2409

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.

Read the vendor bulletin Get alerts for Cloud Suite
9.3CVSS out of 10Critical severity
Scope

What the vendor says is affected

  • Cloud Suite before 25.2 HF1Resolution:Upgrade to Cloud Suite version 25.2 HF1 or later

Versions the vendor lists as fixed

  • Upgrade to Cloud Suite version 25.2 HF1 or later
Next step

What the vendor recommends

Upgrade to Cloud Suite version 25.2 HF1 or later

Review the complete instructions on the vendor's site
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Severity changed from Low to Critical.
    • CVSS changed from 3.8 to 9.3.
    • Added CVEs: CVE-2026-2409.
    • Removed CVEs: CVE-2025-6943.
    • Added affected products: Cloud Suite before 25.2 HF1Resolution:Upgrade to Cloud Suite version 25.2 HF1 or later.
    • Removed affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later.
    • Added fixed versions: Upgrade to Cloud Suite version 25.2 HF1 or later.
    • Removed fixed versions: Upgrade to Secret Server version 11.7.60 or later.
    • The vendor changed its remediation guidance.
    • Added affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later.
    • Removed affected products: Delinea Secret Server on-prem version 11.7.49 and earlier ResolutionUpgrade to Secret Server version 11.7.60 or later CVE Details CVE ID: CVE-2025-6943 Published Date: July 2, 2025 Vulnerability Type: Improper Privilege....
    • Added fixed versions: Upgrade to Secret Server version 11.7.60 or later.
    • Removed fixed versions: Upgrade to Secret Server version 11.7.60 or later CVE Details CVE ID: CVE-2025-6943 Published Date: July 2, 2025 Vulnerability Type: Improper Privilege Management CWE: 269 CVSS v3 Score: 3.8 CVSS v3 Vector....
    • The vendor changed its remediation guidance.
Timeline

When this advisory changed

  1. Published by Delinea

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Vulnerabilities

CVEs named in this advisory

CVE-2026-2409View CVSS, KEV, EPSS, and threat context
Keep investigating
See every advisory from this vendor