Search threats, CVEs… ⌘K
Back to vendor advisories
Delinea Security AdvisoriesCVE-2026-19117

Delinea Secret Server on-prem FIDO2 credential registration authentication bypass vulnerability - CVE-2026-19117

CriticalVendor CVSS 9.8 / 10 1 CVE Published Sep 2, 2026 at 12:00 AM UTC

Summary

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.

Products covered

  • Delinea Secret Server on-prem 10.6.0 through 11.7.61 11.8.0 through 11.8.1 11.9.0 through 11.9.47 12.0.0 through 12.0.22 12.1.0 through 12.1.2 Resolution:Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.Customers on versions prior to 11.7 should upgrade to a supported version to address this vulnerability

Remediation

Vendor-listed fixes

  • Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.Customers on versions prior to 11.7 should upgrade to a supported version to address this vulnerability

CVEs in this advisory 1

CVE-2026-19117
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Severity changed from Medium to Critical.
    • CVSS changed from 6.9 to 9.8.
    • Added CVEs: CVE-2026-19117.
    • Removed CVEs: CVE-2025-12811.
    • Added affected products: Delinea Secret Server on-prem 10.6.0 through 11.7.61 11.8.0 through 11.8.1 11.9.0 through 11.9.47 12.0.0 through 12.0.22 12.1.0 through 12.1.2 Resolution:Upgrade to secret server version 12.2.7 or later, or upgrade to....
    • Removed affected products: Delinea Cloud Suite and Privileged Access Service version 25.1 HF4 and earlier.
    • Added fixed versions: Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.Customers on versions prior to 11.7 should upgrade to a supported version to....
    • Removed fixed versions: Upgrade to version 25.1 HF5 or later.
    • The vendor changed its remediation guidance.

Updates

  1. Added to SecurityAlert

    We collected the advisory from the official source.

  2. Published by Delinea

    The publication date reported by the vendor.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor