https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-12810.htmlhttps://patchthecve.com/cve/CVE-2025-12810.htmlWed, 17 Jun 2026 08:32:59 +0000MEDIUM 6.5: Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reachihttps://patchthecve.com/cve/CVE-2025-6943.htmlhttps://patchthecve.com/cve/CVE-2025-6943.htmlWed, 17 Jun 2026 10:02:54 +0000LOW 3.8: Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.https://patchthecve.com/cve/CVE-2024-12908.htmlhttps://patchthecve.com/cve/CVE-2024-12908.htmlWed, 17 Jun 2026 07:00:44 +0000MEDIUM 6.9: Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfullyhttps://patchthecve.com/cve/CVE-2024-33891.htmlhttps://patchthecve.com/cve/CVE-2024-33891.htmlWed, 17 Jun 2026 07:32:30 +0000HIGH 8.8: Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.https://patchthecve.com/cve/CVE-2024-25653.htmlhttps://patchthecve.com/cve/CVE-2024-25653.htmlWed, 17 Jun 2026 07:16:22 +0000MEDIUM 4.3: Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is enabled, to view system reports and modify custom reports via the Report functionality in the Web UI.https://patchthecve.com/cve/CVE-2024-25652.htmlhttps://patchthecve.com/cve/CVE-2024-25652.htmlWed, 17 Jun 2026 07:16:22 +0000HIGH 7.6: In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionality via UNLIMITED ADMIN MODE (with access to the Report functionality) to gain unauthorized access to remote sessions created by legitimate users through inforhttps://patchthecve.com/cve/CVE-2024-25651.htmlhttps://patchthecve.com/cve/CVE-2024-25651.htmlWed, 17 Jun 2026 07:16:21 +0000MEDIUM 5.3: User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint.https://patchthecve.com/cve/CVE-2024-25649.htmlhttps://patchthecve.com/cve/CVE-2024-25649.htmlWed, 17 Jun 2026 07:16:21 +0000MEDIUM 6.7: In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the following data from a memory dump: the decrypted master key, database credentials (when SQL Server Authentication is enabled), the encryption key of RabbitMQ queue mhttps://patchthecve.com/cve/CVE-2024-25650.htmlhttps://patchthecve.com/cve/CVE-2024-25650.htmlWed, 17 Jun 2026 07:16:21 +0000MEDIUM 5.9: Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symmetric Key (used to encrypt RabbitMQ messages) via crafted payloads to the /pre-authenticate, /authenticate, and /execute-and-respond REST API endpoints. This mak