JavaScript Injection Vulnerability in Delinea Products
CVE-2026-15639

9.3CRITICAL

Key Information:

Vendor

Delinea

Status
Secret Server (on-prem)
Vendor
CVE Published:
15 September 2026

What is CVE-2026-15639?

A JavaScript injection vulnerability allows attackers to create malicious links that, when interacted with by a legitimate user, may execute unauthorized JavaScript code within the user's browser. This could potentially lead to data breaches or unauthorized access to sensitive information. It is crucial for users of Delinea products to remain vigilant against such threats and implement recommended security measures to mitigate risks.

Affected Version(s)

Secret Server (On-Prem) 10.2.19 <= 11.9.48

References

https://delinea.com/security-advisories
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.