Delinea's 2 September hotfixes all land inside the new SAML impersonation range

On 2 September Delinea listed five hotfix builds for the FIDO2 credential registration bug: 12.1.3, 12.0.23, 11.9.48, 11.8.2 and 11.7.62 ^[7]. CVE-2026-15640 affects on-prem Secret Server 10.5.0 through 12.1.3 ^[1]. All five of those builds sit at or below that ceiling, so none of them is outside the SAML range ^[9]. The two advisories carry publication dates thirteen days apart ^[15].

The padding oracle published on the later date, CVE-2026-15638, covers 10.5.1 through 12.1.3 and resolves in the same build, 12.2.7 ^[5]. The cross-site scripting issue, CVE-2026-15639, affects 10.2.19 through 11.9.48 and resolves in 12.0.20 ^[4]. Version 12.2.7 is above the top of all four on-prem ranges on the page, so a single upgrade takes an installation out of every one of them ^[10].

Delinea published the vector as well as the score: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H ^[3]. On the exploitability metrics only AC:H and AT:P are below their worst values, so the advisory has the attack arriving over the network with no privileges and no user interaction ^[11]. Confidentiality, integrity and availability are all High for subsequent systems, while the vulnerable system's own availability impact is None ^[12].

A base score is a claim about a reference deployment. For 9.5 to describe yours, the Secret Server front end has to be reachable from wherever an attacker sits, and the SAML login path has to be in use. The subsequent-system metrics assume that impersonating a vault user buys access to something else. Delinea's advisory says the impersonation happens under certain conditions and does not describe them ^[16].

The FIDO2 bug carries the bigger number, 9.8, scored under CVSS v3 ^[6]. The three advisories dated 15 September are scored under v4 ^[3]. Different formulas and different metric sets produced those two figures, so ordering a v3 9.8 against a v4 9.5 does not tell you which to patch first ^[13].

Both authentication bypasses land in the same class. Delinea filed CVE-2026-15640 and CVE-2026-19117 under CWE-290, authentication bypass by spoofing, and both sit in the federated and hardware-token login paths ^[18]. All four Secret Server entries name the on-prem product, and the FIDO2 entry adds that it affects on-premises deployments only ^[17][6]. The Cloud Suite items on the same page run on their own track, including CVE-2026-2409, an SQL injection allowing argument injection, scored 9.3 under CVSS v4, fixed in 25.2 HF1 and credited to reporters Jess Parker and Radu Enachi ^[14].