Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-19117 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-02 |
| Vendor | Delinea |
| Product | Secret Server (on-premises deployments only) |
| Vulnerability type | Authentication bypass by spoofing (CWE-290) |
| CVSS Score | 9.8 (critical) |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Fixed version | 12.2.7, or hotfix 12.1.3 / 12.0.23 / 11.9.48 / 11.8.2 / 11.7.62 |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: Delinea advisory
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
The vulnerability is classified as CWE-290 — authentication bypass by spoofing. The FIDO2 credential registration mechanism does not sufficiently verify who is registering a credential and against which account, allowing an attacker to attach their own hardware or software key to somebody else’s account and from that point log in as its owner.
Multi-factor authentication becomes the vector here, not the safeguard. FIDO2 is
deployed precisely to eliminate credential phishing — the key is bound to the domain and
cannot be tricked out of the user. This vulnerability sidesteps that entire model: the
attacker needs neither the victim’s password nor their key, because they register their
own. The CVSS vector AV:N/AC:L/PR:N/UI:N means a network attack of low complexity, with
no privileges required and no user interaction.
Why this product raises the stakes. Delinea Secret Server is a PAM (Privileged Access Management) system — the vault where an organisation keeps passwords for domain controllers, databases, network devices, service accounts and administrative access. Compromising a PAM account is not the compromise of one system; it is potential access to every credential that system manages. The scale of impact depends on whose account the attacker takes over — but even an ordinary PAM user account usually reaches a pool of secrets no outsider should ever see.
Required Actions
- Determine your Secret Server version and compare it against the affected ranges (see “Who Is Affected?” below). If you run the cloud version, this advisory does not apply to you.
- Upgrade to version 12.2.7 or later. This is the target path recommended by the vendor.
- Or apply the appropriate hotfix for your release line: 12.1.3, 12.0.23, 11.9.48, 11.8.2 or 11.7.62. Pick the patch matching the branch you currently run.
- If you run a version older than 11.7, Delinea advises upgrading to a supported version first. Versions before 11.7 did not receive a hotfix.
- After patching, review registered FIDO2 credentials on every account. This is the step applying the patch does not perform for you: if the vulnerability was exploited before the upgrade, the attacker’s key remains registered and still works. Verify the key list per account and remove any the owner cannot recognise.
- Analyse audit logs for new FIDO2 credential registrations and for logins from unusual addresses or at unusual hours — particularly for administrative accounts.
Who Is Affected?
The vulnerability affects Delinea Secret Server on-prem in the following ranges:
- 10.6.0 through 11.7.61
- 11.8.0 through 11.8.1
- 11.9.0 through 11.9.47
- 12.0.0 through 12.0.22
- 12.1.0 through 12.1.2
It does not affect cloud deployments of Secret Server — Delinea explicitly limits the advisory to on-premises installations.
Secret Server (formerly Thycotic) is one of the recognisable PAM solutions in organisations that have formalised privileged access management — typically financial services, telecoms, energy, and entities in scope of NIS2 and DORA. For those organisations the PAM system is usually a documented control in the risk analysis, so a critical vulnerability in it demands not only a patch but also an entry in the incident or exception register.
Sources
- NVD - CVE-2026-19117
- Delinea Security Advisories
- Delinea Secret Server on-prem — release notes
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-19117 vulnerability?
It is an authentication bypass by spoofing (CWE-290) in Delinea Secret Server on-prem, rated 9.8 CVSS. Under specific conditions an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user.
Does this affect the cloud version of Secret Server?
No. Delinea states explicitly that the issue affects on-premises deployments only. Customers using Secret Server in the cloud model are not covered by this particular advisory.
Which Delinea Secret Server versions are affected?
Delinea lists these ranges: 10.6.0 through 11.7.61, 11.8.0 through 11.8.1, 11.9.0 through 11.9.47, 12.0.0 through 12.0.22 and 12.1.0 through 12.1.2.
How do I remediate it?
Upgrade Secret Server to version 12.2.7 or later, or apply one of the hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2 or 11.7.62. Customers on versions prior to 11.7 should first move to a supported version.
Why is a vulnerability in a PAM system particularly dangerous?
Secret Server is a privileged password vault — it stores credentials for domain controllers, databases, network devices and service accounts. Compromising an account in a PAM system does not give access to one system, but potentially to every credential that system manages. It is precisely the piece of infrastructure meant to be the last line of defence against privilege escalation.
