PT-2026-93221 · Thycotic · Secret Server
CVE-2026-15638
·
Published
2026-09-15
·
Updated
2026-09-17
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
Secret Server (affected versions not specified)
Description
An unauthenticated user with access to Secret Server can utilize a padding oracle—a side-channel attack that reveals information about the padding of encrypted data—to decrypt or encrypt data using one of the server's cryptographic keys. The cryptographic key itself remains unexposed during this process.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of a Broken Cryptographic Algorithm
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Secret Server