CVE-2026-19117CWE-290

CVE-2026-19117

Critical · published September 2, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as

that user. This issue affects on-premises deployments only.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-09-02T23:17Z
References (1)
https://delinea.com/security-advisories · 1443cd92-d354-46d2-9290-d812316ca43a
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 02 SEP 18:04Z
    Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability
    cvelistv5