Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-19117 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-02 |
| Vendor | Delinea |
| Product | Secret Server (on-premises deployments only) |
| Vulnerability type | Authentication bypass by spoofing (CWE-290) |
| CVSS Score | 9.8 (critical) |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Fixed version | 12.2.7, or hotfix 12.1.3 / 12.0.23 / 11.9.48 / 11.8.2 / 11.7.62 |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: Delinea advisory
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
The vulnerability is classified as CWE-290 — authentication bypass by spoofing. The FIDO2 credential registration mechanism does not sufficiently verify who is registering a credential and against which account, allowing an attacker to attach their own hardware or software key to somebody else’s account and from that point log in as its owner.
Multi-factor authentication becomes the vector here, not the safeguard. FIDO2 is
deployed precisely to eliminate credential phishing — the key is bound to the domain and
cannot be tricked out of the user. This vulnerability sidesteps that entire model: the
attacker needs neither the victim’s password nor their key, because they register their
own. The CVSS vector AV:N/AC:L/PR:N/UI:N means a network attack of low complexity, with
no privileges required and no user interaction.
Why this product raises the stakes. Delinea Secret Server is a PAM (Privileged Access Management) system — the vault where an organisation keeps passwords for domain controllers, databases, network devices, service accounts and administrative access. Compromising a PAM account is not the compromise of one system; it is potential access to every credential that system manages. The scale of impact depends on whose account the attacker takes over — but even an ordinary PAM user account usually reaches a pool of secrets no outsider should ever see.
Required Actions
- Determine your Secret Server version and compare it against the affected ranges (see “Who Is Affected?” below). If you run the cloud version, this advisory does not apply to you.
- Upgrade to version 12.2.7 or later. This is the target path recommended by the vendor.
- Or apply the appropriate hotfix for your release line: 12.1.3, 12.0.23, 11.9.48, 11.8.2 or 11.7.62. Pick the patch matching the branch you currently run.
- If you run a version older than 11.7, Delinea advises upgrading to a supported version first. Versions before 11.7 did not receive a hotfix.
- After patching, review registered FIDO2 credentials on every account. This is the step applying the patch does not perform for you: if the vulnerability was exploited before the upgrade, the attacker’s key remains registered and still works. Verify the key list per account and remove any the owner cannot recognise.
- Analyse audit logs for new FIDO2 credential registrations and for logins from unusual addresses or at unusual hours — particularly for administrative accounts.
Who Is Affected?
The vulnerability affects Delinea Secret Server on-prem in the following ranges:
- 10.6.0 through 11.7.61
- 11.8.0 through 11.8.1
- 11.9.0 through 11.9.47
- 12.0.0 through 12.0.22
- 12.1.0 through 12.1.2
It does not affect cloud deployments of Secret Server — Delinea explicitly limits the advisory to on-premises installations.
Secret Server (formerly Thycotic) is one of the recognisable PAM solutions in organisations that have formalised privileged access management — typically financial services, telecoms, energy, and entities in scope of NIS2 and DORA. For those organisations the PAM system is usually a documented control in the risk analysis, so a critical vulnerability in it demands not only a patch but also an entry in the incident or exception register.
Sources
- NVD - CVE-2026-19117
- Delinea Security Advisories
- Delinea Secret Server on-prem — release notes
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
