CVE-2026-15638

CVE-2026-15638 is a padding oracle vulnerability in Delinea Secret Server that allows an unauthenticated attacker with network access to a Secret Server instance to decrypt existing ciphertext or encrypt new data using one of the server's own cryptographic keys, without ever learning the key itself. It is triggered by sending carefully crafted encrypted payloads to the server and observing padding-validity differences in responses, a classic chosen-ciphertext technique (CWE-327, use of a broken or risky cryptographic construction). Successful exploitation lets an attacker read protected data handled by the server — a serious concern since Secret Server is a privileged access management vault storing credentials for downstream systems — and forge encrypted data, with CVSS 4.0 rating it critical (9.1) largely due to high confidentiality impact on both the vault and subsequent systems. Note the vector requires high attack complexity and present attack prerequisites, so exploitation is non-trivial despite the score. There is no known public proof-of-concept, no confirmed exploitation in the wild, and the CVE is not on CISA's KEV list.

What to do: Apply Delinea's patched Secret Server release as soon as it is available per the vendor's security bulletin, prioritizing any instance reachable from untrusted networks. Restrict access to Secret Server endpoints via VPN or IP allowlisting, since the attack requires network access to the server. After patching, review logs for anomalous repeated or failed decryption attempts against encrypted fields and rotate high-value stored secrets and the server's crypto items if suspicious activity is found.