Description
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Published: 2026-09-15
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to secret server version 12.2.7 or later.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://delinea.com/security-advisories cve-icon cve-icon
History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Title Cryptographic Padding Oracle
Weaknesses CWE-327
References
Metrics cvssV4_0

{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Delinea

Published:

Updated: 2026-09-16T19:36:54.361Z

Reserved: 2026-07-13T18:18:20.775Z

Link: CVE-2026-15638

cve-icon Vulnrichment

Updated: 2026-09-16T19:36:46.871Z

cve-icon NVD

Status : Received

Published: 2026-09-16T00:17:02.600

Modified: 2026-09-16T20:17:20.950

Link: CVE-2026-15638

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T18:15:15Z

Weaknesses