Delinea Cloud Suite and Privileged Access Service - SQL Injection vulnerability - CVE-2025-12812

• Delinea Cloud Suite and Privileged Access Service version 23.1.2 and earlier

Upgrade to Cloud Suite version 25.1 or later

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Sep 2, 2026 at 7:00 PM UTC
   • The vendor changed the advisory title.
   • The vendor changed the advisory summary.
   • The vendor changed the advisory ID.
   • Added CVEs: CVE-2025-12812.
   • Removed CVEs: CVE-2025-12810.
   • Added affected products: Delinea Cloud Suite and Privileged Access Service version 23.1.2 and earlier.
   • Removed affected products: Delinea Secret Server on-prem versions 11.8.1, 11.9.6, and 11.9.25.
   • Added fixed versions: Upgrade to Cloud Suite version 25.1 or later.
   • Removed fixed versions: Upgrade to Secret Server version 11.9.47 or later The secret will remain checked out when the password change fails..
   • The vendor changed its remediation guidance.

1. Feb 12, 2026 at 12:00 AM UTC
   Published by Delinea

   The publication date reported by the vendor.

2. Aug 20, 2026 at 2:50 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

3. Sep 13, 2026 at 4:15 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.