A critical vulnerability, CVE-2026-15640, exists in Delinea Secret Server. Under certain conditions, a valid SAML IdP response may be used to impersonate another user. This vulnerability has a CVSS score of 9.5, indicating critical severity. It was published on 2026-09-16T00:17:03.577Z and last modified on 2026-09-18T19:34:36.657Z. Defenders should assess exposure, verify user authentication and authoriza [truncated]
A critical vulnerability CVE-2026-15639 allows attackers to craft malicious links that can execute attacker-supplied JavaScript in a user's browser if clicked. This issue has a CVSS score of 9.3 and is considered critical. The CVE was published on 2026-09-16T00:17:03.453Z and last modified on 2026-09-18T19:34:36.657Z. The NVD entry is currently Awaiting Analysis.
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed. This critical vulnerability affects Secret Server instances, allowing potential unauthorized data access or manipulation. Defenders should prioritize verifying exposure and assessing potential impact, focusing on Secret [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-02T19:17:16.490Z and has not been modified since then. This critical vulnerability allows an attacker to register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user, affecting on-premises deployments. The issue emphasizes the need for immediate action [truncated]
