CVE-2026-15638: Secret Server Information Disclosure Flaw

CVE-2026-15638 Overview

CVE-2026-15638 is a padding oracle vulnerability in Delinea Secret Server. An unauthenticated attacker with network access to Secret Server can exploit the flaw to decrypt or encrypt data using one of the server's cryptographic keys. The cryptographic key itself is not exposed, but the ability to perform cryptographic operations with server-held keys undermines the confidentiality and integrity guarantees of protected secrets. The weakness maps to CWE-327: Use of a Broken or Risky Cryptographic Algorithm.

Critical Impact
Unauthenticated attackers can decrypt sensitive secrets and forge encrypted values processed by Secret Server without ever obtaining the underlying key material.

Affected Products

Delinea Secret Server (see Delinea Security Advisories for affected versions)
On-premises Secret Server deployments exposed to attacker-reachable networks
Any Secret Server instance whose cryptographic endpoint accepts unauthenticated requests

Discovery Timeline

2026-09-16 - CVE-2026-15638 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-15638

Vulnerability Analysis

The vulnerability is a classic padding oracle in a cryptographic routine used by Delinea Secret Server. Padding oracles arise when a system reveals, through error messages, response codes, or timing differences, whether the padding of a decrypted ciphertext is valid. An attacker who can submit chosen ciphertexts and observe those signals can iteratively recover plaintext bytes or craft ciphertexts that decrypt to attacker-chosen values.

Because the server processes requests without requiring authentication, any network-reachable client can drive the oracle. The result is functional access to the server's cryptographic key: attackers can decrypt intercepted or stored ciphertexts and produce forged encrypted blobs the server will accept as legitimate. Given that Secret Server stores privileged credentials, the downstream impact extends to any secret protected by the affected key.

Root Cause

The root cause is the use of a symmetric cipher mode, typically Cipher Block Chaining (CBC), combined with PKCS#7-style padding, where padding validation errors are distinguishable from other decryption failures. When padding validation and message authentication are not enforced together with a constant-time comparison, the server behaves as an oracle and leaks one bit of information per query about the plaintext.

Attack Vector

The attack requires network access to Secret Server but no credentials. An attacker sends a crafted ciphertext to an endpoint that performs decryption using the server's key. By observing whether the response indicates a padding error, a decryption failure, or a successful parse, the attacker recovers plaintext one byte at a time using the standard Vaudenay padding oracle technique. The same primitive enables the attacker to construct ciphertexts that decrypt to chosen plaintexts, effectively signing arbitrary encrypted payloads.

No verified proof-of-concept code is publicly available. Refer to the Delinea Security Advisories for vendor-specific technical detail.

Detection Methods for CVE-2026-15638

Indicators of Compromise

High volumes of requests to Secret Server cryptographic or API endpoints from a single source, consistent with iterative oracle queries.
Repeated HTTP responses indicating decryption or padding failures immediately followed by successful requests from the same client.
Unexpected access patterns from unauthenticated sessions targeting endpoints that handle encrypted parameters.

Detection Strategies

Enable verbose Secret Server audit logging and alert on bursts of decryption or cryptographic errors originating from unauthenticated sessions.
Deploy web application firewall rules that rate-limit and inspect requests to Secret Server endpoints handling ciphertext parameters.
Correlate network flow data with application logs to identify sustained low-and-slow probing consistent with padding oracle exploitation.

Monitoring Recommendations

Forward Secret Server application, IIS, and Windows Event logs to a centralized SIEM for anomaly analysis.
Baseline normal cryptographic error rates and alert on statistically significant deviations.
Monitor for unusual issuance or use of secrets shortly after suspicious activity against Secret Server.

How to Mitigate CVE-2026-15638

Immediate Actions Required

Apply the patched Secret Server release identified in the Delinea Security Advisories as soon as it is available for your deployment.
Restrict network access to Secret Server so that only trusted administrative networks can reach the application endpoints.
Rotate secrets stored in Secret Server and rotate the server's cryptographic keys after patching, on the assumption that ciphertexts may have been decrypted.
Review audit logs for evidence of oracle-style probing and treat any confirmed exploitation as a full credential-store compromise.

Patch Information

Delinea publishes fixed versions and remediation guidance on the Delinea Security Advisories portal. Administrators should consult the advisory that references CVE-2026-15638 to identify the minimum fixed build for their Secret Server edition and follow the vendor's upgrade procedure. After patching, rekey the encryption keys and reissue any affected secrets.

Workarounds

Place Secret Server behind a VPN or zero-trust access broker to eliminate unauthenticated network exposure.
Enforce strict allow-lists at the network perimeter for Secret Server management and API endpoints.
Enable and monitor rate limiting on cryptographic endpoints to slow oracle exploitation attempts until the patch is deployed.

bash

# Example: restrict inbound access to Secret Server to a management subnet (Windows firewall)
New-NetFirewallRule -DisplayName "Restrict SecretServer HTTPS" \
  -Direction Inbound -Protocol TCP -LocalPort 443 \
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block SecretServer HTTPS Default" \
  -Direction Inbound -Protocol TCP -LocalPort 443 \
  -Action Block