CVE intelligence

CVE-2025-12810

Vulnerability intelligence

Published Jan 27, 2026Sources checked Oct 27, 2026

6.5MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2025-12810 and is rated Medium severity with a CVSS score of 6.5. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Delinea Security Advisories guidance

Vendor revision: Jan 27, 2026

Vendor-listed releases

Upgrade to Secret Server version 11.9.47 or later The secret will remain checked out when the password change fails.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-12810?

Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25.

A secret with "change password on check in" enabled automatically checks in even when the password change fails after reaching its retry limit. This leaves the secret in an inconsistent state with the wrong password.

Remediation: Upgrade to 11.9.47 or later. The secret will remain checked out when the password change fails.

Source: NVD