CVE-2026-15638CWE-327

CVE-2026-15638

published September 16, 2026

CVSS
9.1
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.

The record
Technical detail
CVSS
9.1 · NONE
CVSS v4.0
9.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H
EPSS
0.00201 · 9.5th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-09-16T04:17Z
References (1)
https://delinea.com/security-advisories · 1443cd92-d354-46d2-9290-d812316ca43a
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 15 SEP 23:20Z
    Cryptographic Padding Oracle
    cvelistv5