The vault that holds everyone’s keys has its own lock broken
Delinea Secret Server, a privileged access management platform designed to secure the enterprise’s most sensitive credentials, has become a high-value attack surface. On September 15, 2026, the company disclosed two unauthenticated Critical vulnerabilities. CVE-2026-15638 and CVE-2026-15640 were both fixed in release 12.2.000007, which arrived on August 28.
The padding oracle
CVE-2026-15638 is a cryptographic padding oracle with a CVSS v4.0 score of 9.1. It affects versions 10.5.1 through 12.1.3. An unauthenticated attacker with network access can leverage the oracle to decrypt or encrypt data using the server’s cryptographic keys. The keys themselves are not exposed, but the ability to manipulate encrypted data within a vault that manages SSH keys, API tokens, database credentials, and service account passwords effectively undermines the confidentiality of the entire credential store.
The release notes for 12.2.000007 confirm the fix under bug 743353: “Cryptographic Weakness in Pre-Authentication Sign-In Features.” The vulnerability is categorized as CWE-327 – Use of a Broken or Risky Cryptographic Algorithm.
The SAML bypass
CVE-2026-15640 presents a more direct path to total compromise. This SAML authentication bypass, rated at 9.5 on the CVSS v4.0 scale, stems from assertion signature wrapping – CWE-290, Authentication Bypass by Spoofing. It affects versions 10.5.0 through 12.1.3. An unauthenticated attacker can impersonate any user, including administrators. By bypassing the authentication layer, an attacker gains the same level of access as a legitimate privileged user, rendering the platform’s security controls moot.
The release notes confirm this fix under bug 743573: “SAML Authentication Bypass Through Assertion Signature Wrapping.” Two Critical CVEs, both unauthenticated, both in the same PAM platform, both disclosed the same day.
Four Critical CVEs in two weeks
These two disclosures are not isolated. They are part of a broader cluster. In the two weeks surrounding these disclosures, Secret Server accumulated four Critical CVEs. In addition to the padding oracle and SAML bypass, the platform suffered from CVE-2026-15639, a reflected cross-site scripting vulnerability rated 9.3 (fixed in 12.0.20), and CVE-2026-19117, a FIDO2 credential registration bypass rated 9.8 (disclosed September 2, fixed in 12.2.7). That last one allowed an attacker to register an attacker-controlled FIDO2 credential against a target account and authenticate as that user. All four vulnerabilities are on-premises only.
Four Critical CVEs in two weeks in a Gartner Magic Quadrant Leader for Privileged Access Management is a signal worth pausing on.
The structural argument
When a PAM platform suffers unauthenticated bypasses, the entire security model it was deployed to enforce collapses. Secret Server manages SSH keys, API tokens, database credentials, and service account passwords – the credentials that, if compromised, give an attacker access to everything else. Centralized credential management creates a single point of failure. When that single point is the target, the blast radius is the entire enterprise.
Delinea, formed from the 2021 merger of Thycotic and Centrify, is a Gartner Magic Quadrant Leader for PAM. Its customer base includes major enterprises: BankUnited, HubSpot, Honda, ESPN, BP, and Cisco. The global PAM market is estimated at approximately $4.51 billion in 2026, projected to reach $30.69 billion by 2034. As the market grows, the incentive for attackers to target these platforms grows with it.
Connections to prior coverage
The Delinea situation confirms a recurring structural pattern documented across prior T/I/S coverage. When the SonicWall SMA1000 leaked TOTP MFA seeds, when the Cisco FMC management plane produced three CISA KEV entries in 2026, when ShieldCrash turned Microsoft Defender’s own scanning engine into a SYSTEM-level file-read vector, and when OpenAI agents exploited identity infrastructure limitations to weaponize public websites – in each case, the infrastructure designed to protect identity or enforce security boundaries became the primary attack surface. Secret Server extends that pattern from network infrastructure and endpoint protection to the vault itself.
What to watch
Organizations running Secret Server on-premises must verify their patch status immediately. Versions 10.5.0 through 12.1.3 are affected by at least three of the four Critical CVEs. The fix is version 12.2.7 or later. Beyond patching, security teams should audit logs for anomalous authentication activity, SAML assertion patterns, and unauthorized vault access – the window between the August 28 release and the September 15 advisory disclosure may have provided an opportunity for exploitation by actors who reverse-engineered the fix.