Delinea Secret Server 12.3.1 Fixes Three Access Flaws
Tech GuruQuick Answer
Delinea Secret Server 12.3.1 fixes three authentication and authorization flaws. Inventory cloud and on-premises tenants, upgrade supported deployments, review high-privilege and MFA activity, validate login, FIDO2, JWT and cloud administration flows, and retain version, audit and change evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Secret Server cloud tenants and on-premises nodes, exact versions, FIDO2 and MFA use, cloudadmin assignments, integrations, owners, backups, and maintenance windows. Confirm Secret Server 12.2.7 or earlier and the relevant authentication flow; do not apply these CVEs to other Delinea products or infer compromise from feature use alone. Upgrade Secret Server to version 12.3.1 through the supported Delinea procedure and coordinate cloud-tenant remediation with the vendor where applicable. Confirm the effective version on every node or tenant, test standard and privileged login, FIDO2, MFA, JWT and cloud administration, review unusual high-privilege activity, and retain evidence.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Delinea Secret Server on-premises and cloud |
|---|---|
| Advisory | Delinea Secret Server October 30, 2026 advisories |
| CVEs | CVE-2026-115828, CVE-2026-115829, CVE-2026-115830 |
| Authoritative release date | 2026-10-30 19:46:25.446 UTC |
| Authority revision date | 2026-10-30 19:58:57.299 UTC |
| Affected versions | Delinea Secret Server on-premises and cloud version 12.2.7 or earlier. |
| Fixed version | Delinea Secret Server version 12.3.1 |
| CVSS base score | 5.1-8.7 (CVSS v4.0; CVE-specific) |
| CVSS severity | Medium to High |
| Exploitation status | Delinea does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Delinea fixed incomplete FIDO2 device validation, partial login bypass, and acceptance of an unsigned JWT that can return cloudadmin permissions under stated conditions.
What To Validate Now
- Inventory. Inventory Secret Server cloud tenants and on-premises nodes, exact versions, FIDO2 and MFA use, cloudadmin assignments, integrations, owners, backups, and maintenance windows.
- Establish applicability. Confirm Secret Server 12.2.7 or earlier and the relevant authentication flow; do not apply these CVEs to other Delinea products or infer compromise from feature use alone.
- Remediate. Upgrade Secret Server to version 12.3.1 through the supported Delinea procedure and coordinate cloud-tenant remediation with the vendor where applicable.
- Validate. Confirm the effective version on every node or tenant, test standard and privileged login, FIDO2, MFA, JWT and cloud administration, review unusual high-privilege activity, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Authentication changes can affect emergency and service access. Preserve break-glass paths, stage on-premises upgrades, and avoid disrupting audit evidence during review.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
