Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Delinea

  • Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead

    Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead

    Four items published today carry a federal remediation deadline of Saturday, September 5. That is two days out, and it is the day’s lead. It outranks the four fresh 9.8s that landed alongside it, because a 9.8 with no confirmed exploitation and no clock attached is a patch you schedule, and a Saturday deadline is a patch somebody has to be at a keyboard for. Two of those 9.8s do not have a release number to install anyway.

    The thread is real, and it is CISA’s. Six of today’s ten stories trace back to one batch of Known Exploited Vulnerabilities additions made on September 2 — four due September 5, two due September 16. Running underneath it is the same problem in three of the four Saturday items: the authoritative record does not cleanly say what to install.

    Deal with SonicWall’s SMA1000 pair first. It is an internet-facing access appliance, it is the third zero-day pair on that product, and the CVE records SonicWall assigned itself list affected builds without naming a fixed one — two days before the deadline. Then JFrog Artifactory, where CISA’s listing is the first government confirmation that the unauthenticated administrative bypass is being exploited, and where the medium-severity Artifactory CVE listed six days earlier is now due five days later than the critical one. Then Sangoma’s Switchvox, where the release notes mark the fix for both cloud and on-premises but the only CPE on the record covers on-premises, so an agency running the cloud edition cannot tell from the record whether it is in scope. Then Kestra, the one of the four whose difficulty is a label rather than a version: CISA files it as OS command injection, and what an attacker actually reaches is a filter asking whether a request path ends with the word configs.

    The two September 16 items are lower on the clock and higher on reach. Starlette’s BadHost is a 6.5 by three independent scorers, which is the number most likely to send a KEV entry to the bottom of a patch queue — and Starlette is what FastAPI is built on, so the inventory question is not “do we run Starlette” but “what did we build on FastAPI.” LiteLLM is the narrower one, and the sharper bug: the MCP endpoint answered a failed key check by substituting an empty authorization object and letting the request through.

    After the clocked items, the 9.8s. Cisco’s Nexus 9000 Silicon One root RCE names ten switch SKUs and points its Fixed Software section at an interactive tool instead of a release number; the record has no CPE data at all. Cisco’s IOS XR hardening release, published the same afternoon, packages an internal audit into seven CVEs across every release, two of them 9.8, with one CVE ID standing for thirteen distinct weakness types. That is Cisco twice in one day, both times with a remediation story that is harder to read than the vulnerability. Delinea’s Secret Server takes a 9.8 at the FIDO2 registration step in a privileged access manager, and NVD deferred the record the following day, leaving it with no machine-matchable version data. And thirteen Craft CMS CVEs arrived from two CNAs, neither of them Craft, onto advisories that say “No known CVE” — with one advisory drawing two IDs and one record carrying a description for a different bug.

    What is still open. SonicWall has not named a fixed build for either SMA1000 CVE with the deadline on Saturday. JFrog has published no in-the-wild statement of its own; the government confirmed exploitation before the vendor did. Sangoma has not resolved the cloud-versus-on-premises scope on the record itself. Cisco’s first IOS XR fix that is not a software maintenance update has not shipped, and it revised the fixed-release list within six hours of publishing it. The Delinea record is deferred, so scanners matching on CPE will not flag an affected install.

  • Delinea patches a 9.8 FIDO2 registration bypass in on-prem Secret Server, and NVD deferred the record a day later with no version data

    Delinea patches a 9.8 FIDO2 registration bypass in on-prem Secret Server, and NVD deferred the record a day later with no version data

    Delinea’s on-premises Secret Server takes a 9.8 authentication bypass at the FIDO2 registration step, and NVD deferred the record the next day, leaving it with no machine-matchable version data.

    What happened

    Delinea, acting as its own CNA, published CVE-2026-19117 on September 2, 2026 at 6:04 p.m. UTC. The record was updated at 6:32 p.m. the same evening. The CVE ID had been reserved on August 6, 2026, four weeks earlier.

    The description is one sentence, and it is the whole flaw:

    “Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.”

    Delinea scored it CVSS 3.1 base 9.8 on the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network reachable, low complexity, no privileges, no user interaction, total loss of confidentiality, integrity, and availability. The weakness is CWE-290, authentication bypass by spoofing.

    The vendor’s advisory, titled “Delinea Secret Server on-prem FIDO2 credential registration authentication bypass vulnerability – CVE-2026-19117,” lists the affected builds as Secret Server (On-Prem) for Windows 10.6.0 through 11.7.61, 11.8.0 through 11.8.1, 11.9.0 through 11.9.47, 12.0.0 through 12.0.22, and 12.1.0 through 12.1.2. That is roughly every on-premises release line still in service. The resolution reads: “Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.”

    The CVE Program record carries a CISA-ADP block updated at 6:32 p.m. UTC on September 2 with SSVC version 2.0.3 values of Exploitation: none, Automatable: yes, and Technical Impact: total. There is no KEV entry, no cisaExploitAdd, and no cisaActionDue. Nobody has reported exploitation, and neither Delinea nor CISA says anyone has.

    The record will not match a scanner

    NVD’s copy of the record has vulnStatus of “Deferred” as of its last modification at 4:41 p.m. UTC on September 3, 2026 — one day after publication. Deferred is NVD’s marker for a record it does not intend to enrich further. The practical consequence is visible in the JSON: the record has no configurations key at all. There are no CPE match strings, no versionStartIncluding, no versionEndIncluding. The version list above exists in the record only as the vendor’s own affected-product text, not as anything a matcher can evaluate.

    The scoring shows the same gap. NVD lists Delinea’s 9.8 with a type of “Secondary.” There is no metric of type “Primary” on the record, because NVD did not analyze it and will not.

    Then there is the reference list, which has exactly one entry: https://delinea.com/security-advisories, tagged as a vendor advisory. That URL is not a page about CVE-2026-19117. It is Delinea’s rolling advisory index, and on September 3 it held seven advisories in one continuous list, from this one down to a pair of Secret Server issues from July 2, 2025. Individual advisories on that page do not have their own URLs. There is a copy-link control, but the entries are headings on a shared page rather than separate documents.

    So the only pointer the world’s vulnerability record has for a 9.8 in a credential vault is a link to the top of a list that will keep growing.

    Why it matters

    Secret Server is a privileged access management product. Its job is to hold the credentials that open everything else — service accounts, local administrator passwords, database logins, the keys an organization deliberately took out of spreadsheets and put somewhere auditable. An authentication bypass in an ordinary application costs you that application. An authentication bypass in the vault costs you whatever the compromised account was entitled to read, and in a well-run deployment that is a great deal, because centralizing secrets is the entire point.

    The specific shape of this flaw is worth sitting with, because it is a failure mode that will recur wherever passkeys are being rolled out. FIDO2 is deployed precisely because it resists phishing and replay: the private key never leaves the authenticator, and the challenge is bound to the origin, so a stolen password or an intercepted code buys nothing. None of that cryptography is broken here. What is broken is registration — the step where a new authenticator is bound to an account.

    Registration is the joint where a passkey deployment is still holding the account together with something weaker than the key it is about to trust. If an attacker can get their own authenticator enrolled against someone else’s account, every property that makes FIDO2 strong then works for the attacker instead. Their key is unphishable. Their challenge-response is genuine. The audit log shows a successful, hardware-backed, second-factor authentication, which is exactly the log line a security team has been trained to read as reassuring. Delinea’s phrase “under specific conditions” leaves the preconditions unstated, and with no per-advisory page and no NVD analysis, there is nowhere else to look for them.

    The record problem compounds the security problem in a way that is becoming this publication’s most repeated finding. An organization running Secret Server 11.9.30 has a scanner that reports on CPE matches. That scanner will not raise this, because there are no CPE matches to raise. The information needed to know you are affected exists — Delinea published it, clearly, with exact build numbers — but it lives as prose on a vendor page and as vendor text inside a record NVD has declined to process. Detection therefore depends on somebody reading, which is the failure mode automated vulnerability management was built to remove.

    That is not a complaint about Delinea, which did the hard part: it reserved an ID, published a real advisory with an exact fix matrix, and scored its own bug at the severity it deserves rather than shading it down. The gap is between a vendor that documented the problem and a record system that did not pick the documentation up. A reader who wants the severity gets it. A tool that wants the version range gets nothing.

    What to do

    Only on-premises Secret Server for Windows is affected; Delinea states the issue does not apply to its cloud deployments. Upgrade to 12.2.7 or later, or apply the hotfix matching your line: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.

    Do not rely on a vulnerability scanner to tell you whether you are exposed. Because the NVD record has no CPE data, CPE-driven tooling has nothing to match against. Check the installed build directly against the affected ranges above.

    Because the flaw is in credential registration rather than in authentication, review enrolled FIDO2 authenticators as well as patching. Pull the list of registered credentials per account, and look for registrations that users did not initiate, registrations clustered in time, or authenticators enrolled against accounts whose owners were not actively setting up a key. A successful login using an attacker-registered credential will not look anomalous in the authentication log, so the registration event is the place where evidence would be.

    Treat any account with an unexplained enrolled authenticator as compromised for the period since that enrollment, and rotate what it could reach — which in a secrets vault means the secrets, not just the account password.

    Sourcing note

    Checked: the CVE Program record for CVE-2026-19117 via the CVE Services API, which gives Delinea as assigner, a reserved date of August 6, 2026, publication at 6:04 p.m. UTC on September 2, 2026, the CNA CVSS 3.1 vector and 9.8 score, CWE-290, and the CISA-ADP SSVC block. Checked: the NVD record for the same CVE, which gives vulnStatus “Deferred,” a single Secondary-type metric with no Primary, a references array containing only the Delinea advisory index, and no configurations key. Checked: Delinea’s security advisories page, which carries the advisory title, affected version list, and resolution text quoted above.

    Not reached: any per-advisory URL for this issue, because Delinea’s page does not publish one. Unresolved: the “specific conditions” that make the registration bypass reachable. Delinea does not state them, and no third-party analysis has been published. Also unresolved: whether NVD will reverse the deferral and attach CPE data later; on the evidence of other recently deferred records, assume it will not. No exploitation has been reported by any source, and this CVE is not in the KEV catalog as of this writing.