Delinea Secret Server login bypass: why 12.2.7 won't save you from this 9.9

Delinea has published three new flaws in self-hosted Secret Server, and on November 5 it raised the worst one to a CVSSdefinitionHow bad a security flaw is, from 0 to 10. Version 4 also tells you if an attacker needs a login, or if special conditions have to be in place. score of 9.9. If you run Secret Server on your own servers at 12.2.7 or earlier, upgrade to 12.3.000002 now, and fence off the login page until you have. That includes anyone who moved to 12.2.7 for the September flaws.

Whoever signs in to the vault as an admin can usually read the domain admin password, and from there reach almost anything else on the network. That's why a login bypass on a PAM vault is worse than the same bug on most other apps. The score tells you how Delinea sees it now: reachable over the network, easy to pull off, no account needed and no help from a user.

The rescoredefinitionWhen a vendor changes the severity of a flaw after publishing it. Tools and tickets that copied the first number can stay out of date. is the part most people will miss. When these CVEs first went public on October 30, the worst was 8.7 and the record said an attacker already needed high privileges, which reads like an insider problem you can schedule for later. Six days later Delinea changed that to no privileges at all, gave the flaw a blunter title and rewrote its description. If your scanner or ticket copied the first record, it may still show 8.7, and the ticket may be sitting in the wrong queue.

On attacks, the picture is calm for now, with one caveat. The CISA catalog of known exploited flaws doesn't list any of the three (we checked catalog 2026.11.04), Delinea's advisory doesn't mention attacks, and we found no public exploit code. CISA's own note on the record says exploitation none and automatable no, but CISA wrote that on October 30, before the rescore. Secret Server also has some history here: after a 2024 login bypass, a security engineer's public write-up included a proof-of-concept exploit. So don't plan around this staying quiet.

For engineers, a few details help. The weakness class is CWE-288, an authentication bypass through an alternate path or channel, which MITRE describes as a product that requires authentication but has another route that doesn't. Delinea's advisory text is thinner than its CVE record: the advisory's title names PIN reset and brute force, but its description only says a user could skip the first step by negotiating the second factordefinitionWhat you show after your password, usually an emailed code or a security key. In this flaw it's the only step the attacker has to pass.. The record adds the unauthenticated PIN generation. Neither says which second factor methods are in play.

Here's our own reading, so treat it as that. Secret Server uses the words "pin code" for its email second factor, where it mails a six-digit code. That makes email PIN users the obvious place to look first, but Delinea hasn't confirmed it. Don't assume you're safe because your admins use something else. Lockout is unclear too: Delinea's docs say each wrong PIN counts toward the Maximum Login Failures limit in a normal sign-in, but nobody has said whether this path respects that counter.

All three flaws share one fix, and there's no hotfix or workaround listed for any of them. The advisory's only resolution is to upgrade to on-prem 12.3.1. Older hotfix builds from the September round don't help, since every version up to and including 12.2.7 is listed as affected.

A word on the 115828 jump, from 5.1 to 9.4. Our reading is that it's the less urgent of the two critical scores, because the score says the attack is harder and depends on specific conditions. A FIDO2definitionWhat sits behind hardware security keys like a YubiKey. You touch the key, and it can ask for its own PIN or your fingerprint first. key is meant to prove someone is holding it and knows its PIN or has the right fingerprint, so if that check is skipped, a lost or stolen key is worth more than it should be. That last step is our reading of the description. Delinea hasn't spelled it out.

Those email checks come from how Delinea documents the normal flow, and they're the cheapest early warning you have. A user with email two-factor who signs in fully gets two LOGIN SUCCESS events in a row, one per phase. A PIN that gets emailed leaves no audit event, only the attempt to use it does, so your SMTP logs are where you'd see the send. Nobody has confirmed that this flaw's path sends email at all. A lone success with no password phase in front of it deserves a question. That pattern is our inference and Delinea hasn't published indicators, so a clean result doesn't prove nothing happened.

# example output. Event names come from Delinea's email 2FA docs; field names vary by SIEM, so match them to yours
# 1. Wrong PINs on one account, or across many accounts from one address
source = secret-server-audit and action = "LOGIN FAILED INVALID TWOFACTOR" | count by user, ip, 10m
# 2. Accounts locked by failures. Look hard at admins nobody says were locked out
source = secret-server-audit and action = "ACCOUNTLOCKEDFAILEDATTEMPTS" | table time user
# 3. PIN emails sent. Check them against real sign-ins, since only the mail server sees a send
source = smtp and subject = "[SecretServer] Pin Code" | table time recipient # any send with no matching sign-in?

This is the second round of critical Secret Server login flaws in about two months. September's FIDO2 and SAML bypasses got fixed in 12.2.7, and here we are telling you 12.2.7 isn't enough. So the durable fix is a vault that can take an emergency upgrade quickly, with a login page few people can reach.

Also look at how many people hold admin roles in the vault, because this flaw lets an attacker choose whose account to target. A short list of named admins, with break-glass accounts sealed and watched, makes the worst case smaller. It also makes the audit review possible in an afternoon.

We implement and upgrade Delinea Secret Server, including the step upgrades, distributed engines and launchers that make these jobs slow. If you want a second pair of hands for the move to 12.3.000002, or a review of who can reach what in your vault afterwards, start with our Delinea page, look at Delinea engineers you can bring in, or take the free assessment to see where your privileged access stands.