An attacker can craft a malicious link that

CVE-2026-15639 is a reflected cross-site scripting flaw in Delinea Secret Server On-Prem versions 10.2.19 through 11.9.48. An attacker crafts a URL containing malicious JavaScript targeting the Secret Server web interface. If a legitimate, authenticated user — typically a PAM administrator — clicks that link, the script executes in the context of their browser session. Because Secret Server is a privileged access management vault storing credentials for servers, databases, service accounts, and cloud infrastructure, successful exploitation gives the attacker the ability to perform API calls as the PAM admin: reading secrets, modifying policies, or creating backdoor accounts.

The CNA-assigned CVSS v4.0 score of 9.3 CRITICAL is inflated for this class of vulnerability. Reflected XSS requires active user interaction (clicking a crafted link), targets a small, security-trained user population (PAM admins), and Secret Server deploys HttpOnly session cookies by default — blocking the simplest cookie-theft vector. The attacker must execute the entire exfiltration payload inline within the reflected context, which requires advance knowledge of the instance's API structure. No public PoC exists, EPSS sits at 0.39%, and there is zero evidence of in-the-wild exploitation. While the blast radius of a successful attack on a PAM vault is genuinely severe, the exploitation prerequisites justify HIGH rather than CRITICAL.

Why this verdict

• Role multiplier — PAM vault with fleet-scale blast radius: Secret Server stores credentials for domain controllers, databases, cloud consoles, and network appliances. 100% of Secret Server installs are PAM by definition. A successful XSS-to-session-hijack chain ends in mass credential exfiltration. This *floors* the verdict at HIGH regardless of exploitation friction.
• User interaction required (Active, per CVSS v4): Reflected XSS requires a PAM administrator to click a crafted link while authenticated. This is social engineering against a security-trained user class — materially harder than exploiting an auth bypass or RCE in the same product.
• HttpOnly cookies block simplest theft vector: Secret Server configures HttpOnly on session cookies by default. The attacker cannot use document.cookie to steal and replay the session externally — they must execute the full exfiltration payload inline, requiring advance knowledge of the REST API structure.
• Zero exploitation evidence and negligible EPSS: No public PoC, no KEV listing, no threat intel reports, and EPSS at 0.39% — all indicators point to low near-term exploitation probability.
• Internal-only attack surface: >99% of Secret Server on-prem deployments are behind corporate firewalls and VPN. External attackers need prior network access to even deliver the payload URL to a context where it resolves.

Why not higher?

Reaching CRITICAL would require either active exploitation evidence or a lower-friction attack path. Reflected XSS demands social engineering of PAM admins — a small, security-aware population — and HttpOnly cookies block the canonical session-theft technique. The attacker must build a bespoke inline payload that calls the Secret Server API and exfiltrates results, all within a single reflected execution context. With zero public PoCs and 0.39% EPSS, the real-world exploitation probability does not justify CRITICAL urgency.

Why not lower?

Dropping below HIGH would ignore the blast radius. Secret Server is *the credential vault* — a successful attack yields every stored secret. The vulnerability requires no authentication to trigger (PR:N in the CVSS vector), the affected version range spans six major versions (10.2–11.9), and the vendor's own CNA scored it 9.3. Even with exploitation friction, the consequence of a single successful phish against a PAM admin is organization-wide credential compromise.

1. Enable strict Content Security Policy with nonce-based script allowlisting — A strict CSP that disallows unsafe-inline and requires nonces for all inline scripts will neutralize reflected XSS payloads entirely. Review your Secret Server IIS configuration and add a Content-Security-Policy header. This is the single most effective mitigation and should be deployed within the noisgate mitigation SLA of 30 days.
2. Enforce Secret checkout and one-time-password rotation — Enable checkout on all high-value secrets so credentials rotate after each use. Even if an attacker exfiltrates credentials via XSS, rotated passwords become invalid within minutes. Verify this is enabled within 30 days.
3. Restrict PAM admin session duration and enforce re-authentication — Shorten session timeouts for administrative accounts to reduce the window during which a reflected XSS payload can operate. Require MFA re-authentication for secret access operations. Deploy within 30 days.
4. Deploy URL rewriting / link-scanning on email and chat platforms — Configure your email gateway and collaboration tools to defang or sandbox links to internal Secret Server URLs originating from external sources. This reduces the phishing delivery vector.
5. Monitor Secret Server audit logs for bulk secret access — Create SIEM alerts for any single session that accesses more than N secrets within a short window. This catches the exfiltration phase of the attack chain. Tune thresholds to your environment.

Run this on the Secret Server application server as a local administrator or domain account with read access to the Secret Server installation directory. Example: .\Check-CVE-2026-15639.ps1 -InstallPath 'C:\inetpub\wwwroot\SecretServer'

#Requires -Version 5.1
<#
.SYNOPSIS
    Checks whether Delinea Secret Server On-Prem is vulnerable to CVE-2026-15639 (Reflected XSS).
.DESCRIPTION
    Reads the Secret Server version from the installed assemblies and compares against
    the affected range (10.2.19 through 11.9.48). Fixed in 12.0.20+.
.PARAMETER InstallPath
    Path to the Secret Server web application root directory.
.OUTPUTS
    VULNERABLE, PATCHED, or UNKNOWN with exit codes 1, 0, 2 respectively.
#>
param(
    [Parameter(Mandatory=$true)]
    [string]$InstallPath
)

$ErrorActionPreference = 'Stop'

try {
    # Locate the main Secret Server assembly
    $dllPath = Join-Path $InstallPath 'bin\Thycotic.ihawu.Business.dll'
    if (-not (Test-Path $dllPath)) {
        # Try alternate assembly name used in newer versions
        $dllPath = Join-Path $InstallPath 'bin\Delinea.SecretServer.Business.dll'
    }
    if (-not (Test-Path $dllPath)) {
        Write-Host 'UNKNOWN - Could not locate Secret Server assembly in the specified path.'
        exit 2
    }

    $versionInfo = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dllPath)
    $version = [System.Version]$versionInfo.ProductVersion
    Write-Host "Detected Secret Server version: $version"

    $minAffected = [System.Version]'10.2.19'
    $maxAffected = [System.Version]'11.9.48'
    $fixedVersion = [System.Version]'12.0.20'

    if ($version -ge $fixedVersion) {
        Write-Host 'PATCHED - Running version >= 12.0.20. CVE-2026-15639 is remediated.'
        exit 0
    } elseif ($version -ge $minAffected -and $version -le $maxAffected) {
        Write-Host 'VULNERABLE - Running an affected version (10.2.19 - 11.9.48). Upgrade to 12.0.20+.'
        exit 1
    } elseif ($version -lt $minAffected) {
        Write-Host 'UNKNOWN - Running a version older than the documented affected range. Manual review recommended.'
        exit 2
    } else {
        Write-Host "UNKNOWN - Version $version does not fall into a recognized range. Manual review recommended."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. Delinea Security Advisories
2. CVE-2026-15639 — CVE Project Record (cvelistV5)
3. Secret Server 12.0.20 Release Notes
4. Delinea Secret Server — Securing ASP Cookies
5. OWASP — Cross-Site Scripting (XSS)
6. FIRST — EPSS FAQ and Scoring
7. NVD — CVE-2026-15639 (awaiting analysis)