Answer in brief
CVE-2026-115829 records a Critical severity (CVSS 9.9) vulnerability in Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force. The current sources do not mark it as known exploited. The current feed maps Delinea/Secret Server (generic), Delinea/Secret Server (On-Prem) (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Delinea/Secret Server (generic), Delinea/Secret Server (On-Prem) (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Delinea/Secret Servergeneric | >=older versions <=12.2.7 | Not reported |
| Delinea/Secret Server (On-Prem)generic | >=older versions <=12.2.7 | Not reported |
Published upstream
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
Quoted source text, attributed separately from HOL analysis.