Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

CVE-2026-15640 is an authentication-bypass-by-spoofing flaw (CWE-290) in Delinea Secret Server on-premises versions 10.5.0 through 12.1.3. When SAML SSO is configured, the application fails to properly validate that a SAML IdP response is bound to the requesting session. An attacker who obtains or replays a valid SAML assertion can manipulate the response to impersonate *any* Secret Server user — including administrators — without knowing their credentials. The fix is in version 12.2.7 and later.

Delinea's own CVSS v4 vector scores this at 9.5 Critical (AV:N/AC:H/AT:P/PR:N/UI:N), which is directionally correct. The AC:H and AT:P modifiers acknowledge that SAML SSO must be enabled and specific conditions must align — but given that Secret Server is a Privileged Access Management vault storing domain-admin passwords, service-account keys, and root credentials, even a high-complexity chain that ends in vault takeover deserves the critical bucket. The vendor severity is appropriate here; if anything, organizations running Secret Server as their sole PAM tier should treat this as an emergency.

Why this verdict

• PAM vault identity = automatic fleet-scale blast radius. Secret Server's entire purpose is storing domain-admin, root, service-account, and cloud-API credentials. Compromising the vault IS compromising the fleet. This is not a theoretical role multiplier — it is the product's design.
• Role multiplier — canonical high-value component. Per the high-value role catalog, Secret Server is a PAM / secret manager. 100% of installs occupy this role. The chain (auth bypass → admin impersonation → secret export → DA/root/cloud creds) ends in domain takeover and fleet compromise. Verdict floor: CRITICAL.
• No authentication required (PR:N). The CVSS vector confirms no prior Secret Server privileges are needed. The attacker needs a valid IdP-signed assertion (obtainable with any IdP account or via interception), but does not need a Secret Server account. This is a pre-auth attack path against the PAM tier.
• AC:H and AT:P provide friction but do not break the floor. SAML SSO must be enabled (not default), the attacker needs a signed assertion, and network access to the web UI is required. These narrow the reachable population but do not change what happens when the chain lands: total vault compromise. Friction sets the score at 9.2 rather than 9.8 — it does not drop the bucket below CRITICAL.
• Subsequent-system impact is maximal. The CVSS v4 vector rates SC:H/SI:H/SA:H — compromise of Secret Server cascades to every system whose credentials it stores. This is the definition of a supply-chain-adjacent pivot point.

Why not higher?

The score is 9.2 rather than 10.0 because attack complexity is high (AC:H) and specific prerequisites must align (AT:P): SAML SSO must be explicitly configured, the attacker needs a legitimately-signed IdP assertion, and Secret Server is rarely internet-facing. These friction points meaningfully reduce the probability of opportunistic exploitation, even though they do not reduce the consequence.

Why not lower?

Downgrading below CRITICAL would require evidence that the PAM vault role does not produce fleet-scale compromise — which contradicts the product's core function. The component IS the secret store; there is no 'low-value role' deployment of Secret Server. Even with AC:H friction, an auth bypass on a PAM vault cannot be assessed below the CRITICAL floor per blast-radius rules.

1. Disable SAML SSO and revert to local or LDAP/AD authentication immediately — This eliminates the attack vector entirely. If SAML SSO is not enabled, the vulnerability is not exploitable. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL findings. Coordinate with your IdP team to redirect authentication flows.
2. Restrict network access to Secret Server's ACS endpoint via firewall rules — Limit inbound access to the SAML Assertion Consumer Service URL to only the IP addresses of your IdP's assertion delivery infrastructure. This prevents attackers from submitting forged assertions from arbitrary network positions. Deploy within 3 days.
3. Enable and monitor Secret Server audit logs for impersonation indicators — Configure SIEM alerts for: (1) Secret Server logins where the source IP does not match IdP-correlated sessions, (2) admin-role sessions initiated via SAML, (3) bulk secret checkout events. This provides detection-in-depth while patching is underway.
4. Rotate high-value secrets stored in Secret Server — After patching or disabling SAML, rotate domain admin credentials, service accounts, SSH keys, and cloud API tokens stored in the vault. Assume potential compromise if SAML SSO was enabled on an affected version. Prioritize credentials with domain-admin or equivalent privilege.
5. Enforce IP allowlisting on the Secret Server web UI — Restrict web UI access to known admin workstation subnets and VPN egress points. This reduces the attack surface even for internal attackers. Deploy within 3 days.

Run on the Secret Server host or any Windows workstation with network access to the Secret Server web API. Execute as a domain user with read access to the Secret Server installation directory. Example: .\Check-CVE-2026-15640.ps1 -SecretServerUrl https://secretserver.corp.local/SecretServer

#Requires -Version 5.1
<#
.SYNOPSIS
  Checks whether Delinea Secret Server is vulnerable to CVE-2026-15640.
.DESCRIPTION
  Verifies the installed Secret Server version and SAML SSO configuration status.
  Outputs VULNERABLE, PATCHED, or UNKNOWN.
.PARAMETER SecretServerUrl
  Base URL of the Secret Server instance (e.g., https://secretserver.corp.local/SecretServer)
#>
param(
    [Parameter(Mandatory=$true)]
    [string]$SecretServerUrl
)

$ErrorActionPreference = 'Stop'
$exitCode = 2  # UNKNOWN

try {
    # Attempt to retrieve version from the Secret Server diagnostics page or API
    $versionUrl = "$($SecretServerUrl.TrimEnd('/'))/api/v1/version"
    
    try {
        $response = Invoke-RestMethod -Uri $versionUrl -Method Get -UseDefaultCredentials -TimeoutSec 10
        $versionString = $response.model.version
    } catch {
        # Fallback: check local install if running on the SS host
        $regPaths = @(
            'HKLM:\SOFTWARE\Thycotic\Secret Server',
            'HKLM:\SOFTWARE\Delinea\Secret Server'
        )
        $versionString = $null
        foreach ($rp in $regPaths) {
            if (Test-Path $rp) {
                $versionString = (Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue).Version
                if ($versionString) { break }
            }
        }
    }

    if (-not $versionString) {
        Write-Host 'UNKNOWN - Could not determine Secret Server version via API or registry.'
        exit 2
    }

    Write-Host "Detected Secret Server version: $versionString"

    # Parse version
    $ver = [System.Version]$versionString
    $fixedVer = [System.Version]'12.2.7'
    $minAffected = [System.Version]'10.5.0'

    if ($ver -ge $fixedVer) {
        Write-Host "PATCHED - Version $versionString is >= 12.2.7 (fixed). CVE-2026-15640 is remediated."
        $exitCode = 0
    } elseif ($ver -ge $minAffected -and $ver -lt $fixedVer) {
        # Check if SAML SSO is configured (presence of SAML config in web.config or DB)
        $samlIndicator = 'SAML status could not be determined (check manually)'
        $webConfigPath = Join-Path (Split-Path $SecretServerUrl -ErrorAction SilentlyContinue) 'web.config'
        # Best-effort: check if SAML login endpoint responds
        try {
            $samlUrl = "$($SecretServerUrl.TrimEnd('/'))/saml/login"
            $samlCheck = Invoke-WebRequest -Uri $samlUrl -Method Head -UseDefaultCredentials -TimeoutSec 5 -ErrorAction Stop
            if ($samlCheck.StatusCode -eq 200 -or $samlCheck.StatusCode -eq 302) {
                $samlIndicator = 'SAML SSO appears ENABLED (endpoint responded)'
            }
        } catch {
            $samlIndicator = 'SAML SSO may be DISABLED (endpoint not reachable)'
        }
        Write-Host "VULNERABLE - Version $versionString is in affected range (10.5.0 - 12.1.3). $samlIndicator"
        $exitCode = 1
    } else {
        Write-Host "PATCHED - Version $versionString is below affected range (< 10.5.0). Not affected."
        $exitCode = 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $($_.Exception.Message)"
    $exitCode = 2
}

exit $exitCode

Sources

1. Delinea Security Advisories
2. SAML's Rough Quarter: Five Critical Vulnerabilities — WorkOS
3. CWE-290: Authentication Bypass by Spoofing — MITRE
4. Delinea Secret Server Market Share — 6sense
5. SAML Authentication Replay in Rancher (comparable pattern) — GitHub Advisory
6. Common SAML Security Vulnerabilities — WorkOS Guide
7. Sign in as Anyone: Bypassing SAML SSO — GitHub Blog