CVE-2026-15638
CriticalCVSS 9.1Summary
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Risk Assessment
An attacker may decrypt or modify data protected by the server, potentially leading to disclosure of confidential information or data integrity compromise.
Recommendation
Apply the vendor's available patches for Secret Server addressing the padding oracle vulnerability. Until the fix is deployed, consider restricting access to vulnerable interfaces.
Other vulnerabilities in Secret Server
See all- CVE-2026-15640Critical
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.
- CVE-2026-15639Critical
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.
Original NVD description (English source)
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.