Delinea vulnerabilities
We track 10 vulnerabilities in Delinea products across 3 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Delinea vulnerabilities
- 8.7 High severity
Secret Server (On-Prem): Incorrect Authorization
In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
- 9.9 Critical severity
Secret Server (On-Prem): Authentication Bypass Using an Alternate Path or Channel
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- 9.4 Critical severity
Secret Server (On-Prem): Improper Access Control
In Secret Server on-prem versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device
- 9.1 Critical severity
Secret Server (On-Prem): Use of a Broken or Risky Cryptographic Algorithm
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
- 9.8 Critical severity
Secret Server (On-Prem): Authentication Bypass by Spoofing
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
- 9.3 Critical severity
Cloud Suite: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue affects Cloud Suite: before 25.2 HF1.
- 8.3 High severity
Secret Server: Improper Control of Generation of Code
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approve
- 8.8 High severity
secret_server: Use of Hard-coded Cryptographic Key
Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirati
- 8.4 High severity
Secret Server: Improper Authentication
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions c
- 7.2 High severity
Secret Server: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, the