https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-12810.htmlhttps://patchthecve.com/cve/CVE-2025-12810.htmlWed, 17 Jun 2026 08:32:59 +0000MEDIUM 6.5: Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 11.9.6, 11.9.25. A secret with "change password on check in" enabled automatically checks in even when the password change fails after reachihttps://patchthecve.com/cve/CVE-2025-6943.htmlhttps://patchthecve.com/cve/CVE-2025-6943.htmlWed, 17 Jun 2026 10:02:54 +0000LOW 3.8: Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to restricted tables.https://patchthecve.com/cve/CVE-2024-12908.htmlhttps://patchthecve.com/cve/CVE-2024-12908.htmlWed, 17 Jun 2026 07:00:44 +0000MEDIUM 6.9: Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfullyhttps://patchthecve.com/cve/CVE-2024-5866.htmlhttps://patchthecve.com/cve/CVE-2024-5866.htmlWed, 17 Jun 2026 08:16:48 +0000MEDIUM 5.0: Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing listing of arbitrary directory outside the root directory of the web application. Versions 23.1-HF7 and on have the patch.https://patchthecve.com/cve/CVE-2024-5865.htmlhttps://patchthecve.com/cve/CVE-2024-5865.htmlWed, 17 Jun 2026 08:16:48 +0000HIGH 7.7: Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch.https://patchthecve.com/cve/CVE-2024-33891.htmlhttps://patchthecve.com/cve/CVE-2024-33891.htmlWed, 17 Jun 2026 07:32:30 +0000HIGH 8.8: Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.