CVE-2026-15639
CriticalCVSS 9.3Summary
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.
Risk Assessment
A user clicking the malicious link may fall victim to an XSS attack, potentially leading to session theft, data leakage, or unauthorized actions performed on their behalf.
Recommendation
Apply the vendor's available patches for the affected product. Inform users about the risks of clicking unknown links.
Other vulnerabilities in Secret Server
See all- CVE-2026-15640Critical
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.
- CVE-2026-15638Critical
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Original NVD description (English source)
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.