Delinea fixed two unauthenticated critical flaws in its credential vault 18 days before disclosing them

Both flaws sit in code that runs before a user proves who they are. Delinea's release notes file the padding oracle under bug 743353, "Cryptographic Weakness in Pre-Authentication Sign-In Features," and categorise it as CWE-327, use of a broken or risky cryptographic algorithm ^[5][6]. The server's keys themselves stay unexposed; what an unauthenticated attacker with network access gets, according to Forkast, is the ability to decrypt or encrypt data using those keys, at CVSS v4.0 9.1, in versions 10.5.1 through 12.1.3 ^[4][3].

The SAML flaw is the more direct one. Delinea's notes list it as bug 743573, "SAML Authentication Bypass Through Assertion Signature Wrapping" ^[9], and Forkast reports that an unauthenticated attacker can impersonate any user, administrators included, gaining the same level of access as a legitimate privileged user ^[8]. It is rated 9.5 and affects 10.5.0 through 12.1.3 ^[7], one version lower at the bottom of the range than the padding oracle ^[22].

Release 12.2.000007 shipped on August 28 and the two CVEs were published on September 15, a gap of 18 days ^[2][1][19]. Anyone who first learned of this from the September advisory was reading about a build that had been available for over two weeks.

The four criticals in the fortnight score 9.1, 9.3, 9.5 and 9.8 ^{[3][10][7][11]}. CVSS ranks severity across all deployments of a product. Whether a particular Secret Server sign-in endpoint answers from the internet or only from a management VLAN is the local question, and it is the one that sets your schedule. Forkast reports no exploitation in the wild.

Forkast puts the global PAM market at roughly $4.51bn in 2026 and projects $30.69bn by 2034 ^[17]. That is about 6.8 times over eight years, or roughly 27 percent compounded annually ^[20]. It is a spending forecast. It counts neither on-premises Secret Server instances nor how many of them expose the pre-authentication sign-in path.

The publisher's argument is structural. "Centralized credential management creates a single point of failure. When that single point is the target, the blast radius is the entire enterprise," Forkast wrote ^[18]. Delinea was formed in the 2021 merger of Thycotic and Centrify. It is a Gartner Magic Quadrant Leader for privileged access management, and Forkast lists BankUnited, HubSpot, Honda, ESPN, BP and Cisco among its customers ^[15][16]. Forkast also places these disclosures in a run of cases from its prior coverage where identity infrastructure became the attack surface, among them SonicWall's SMA1000 leaking TOTP MFA seeds and the Cisco FMC management plane producing three CISA KEV entries in 2026 ^[21].