Search threats, CVEs… ⌘K
Back to vendor advisories
Delinea Security AdvisoriesCVE-2026-2409

Delinea Cloud Suite on-prem argument injection vulnerability - CVE-2026-2409

CriticalVendor CVSS 9.3 / 10 1 CVE Published Jan 27, 2026 at 12:00 AM UTC
Get alerts for Cloud Suite

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.

Products covered

  • Cloud Suite before 25.2 HF1Resolution:Upgrade to Cloud Suite version 25.2 HF1 or later

Remediation

Vendor-listed fixes

  • Upgrade to Cloud Suite version 25.2 HF1 or later

CVEs in this advisory 1

CVE-2026-2409
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Severity changed from Medium to Critical.
    • CVSS changed from 5.3 to 9.3.
    • Added CVEs: CVE-2026-2409.
    • Removed CVEs: CVE-2025-12810.
    • Added affected products: Cloud Suite before 25.2 HF1Resolution:Upgrade to Cloud Suite version 25.2 HF1 or later.
    • Removed affected products: Delinea Secret Server on-prem versions 11.8.1, 11.9.6, and 11.9.25.
    • Added fixed versions: Upgrade to Cloud Suite version 25.2 HF1 or later.
    • Removed fixed versions: Upgrade to Secret Server version 11.9.47 or later The secret will remain checked out when the password change fails..
    • The vendor changed its remediation guidance.
    • The vendor changed the advisory title.
    • The vendor changed the advisory summary.
    • The vendor changed the advisory ID.
    • Added CVEs: CVE-2025-12810.
    • Removed CVEs: CVE-2025-12812.
    • Added affected products: Delinea Secret Server on-prem versions 11.8.1, 11.9.6, and 11.9.25.
    • Removed affected products: Delinea Cloud Suite and Privileged Access Service version 23.1.2 and earlier.
    • Added fixed versions: Upgrade to Secret Server version 11.9.47 or later The secret will remain checked out when the password change fails..
    • Removed fixed versions: Upgrade to Cloud Suite version 25.1 or later.
    • The vendor changed its remediation guidance.

Updates

  1. Published by Delinea

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor