Cryptographic Padding Oracle - CVE-2026-15638

• - Delinea Secret Server on-prem 10.5.1 through 12.1.3

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Sep 15, 2026 at 11:20 PM UTC
   • The vendor changed the advisory title.
   • The vendor changed the advisory summary.
   • The vendor changed the advisory ID.
   • Severity changed from Medium to Critical.
   • CVSS changed from 5.3 to 9.1.
   • Added CVEs: CVE-2026-15638.
   • Removed CVEs: CVE-2025-12812.
   • Added affected products: - Delinea Secret Server on-prem 10.5.1 through 12.1.3.
   • Removed affected products: Delinea Cloud Suite and Privileged Access Service version 23.1.2 and earlier.
   • Added fixed versions: - Upgrade to secret server version 12.2.7 or later..
   • Removed fixed versions: Upgrade to Cloud Suite version 25.1 or later.
   • The vendor changed its remediation guidance.
2. Sep 2, 2026 at 7:00 PM UTC
   • The vendor changed the advisory title.
   • The vendor changed the advisory summary.
   • The vendor changed the advisory ID.
   • Added CVEs: CVE-2025-12812.
   • Removed CVEs: CVE-2025-12810.
   • Added affected products: Delinea Cloud Suite and Privileged Access Service version 23.1.2 and earlier.
   • Removed affected products: Delinea Secret Server on-prem versions 11.8.1, 11.9.6, and 11.9.25.
   • Added fixed versions: Upgrade to Cloud Suite version 25.1 or later.
   • Removed fixed versions: Upgrade to Secret Server version 11.9.47 or later The secret will remain checked out when the password change fails..
   • The vendor changed its remediation guidance.

1. Aug 20, 2026 at 2:50 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

2. Sep 15, 2026 at 12:00 AM UTC
   Published by Delinea

   The publication date reported by the vendor.

3. Oct 28, 2026 at 6:10 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.