Read the docs
TI-2024-11959 Aliases CVE-2024-12908GHSA-qq79-x2qm-v335

Code injection in Delinea Secret Server

Priority HIGH 69CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfully exploited, a remote attacker may be able to convince a user to visit a malicious web-page, or open a malicious document which could trigger the vulnerable handler, allowing them to execute arbitrary code on the user's machine. Delinea added additional validation that the downloaded installer's batch file was in the expected format.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00714 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DelineaSecret Server11.7.31—No fix listedCNA
  • Secret Server VendorDelinea Affected 11.7.31 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:delinea:secret_server:*:*:*:*:on-premises:*:*:*before 11.9.000006VulnerableDelinea
  • cpe:2.3:a:delinea:secret_server:*:*:*:*:on-premises:*:*:* Versions before 11.9.000006 Vulnerable ·Delinea

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12908
  2. 2026-10-03 Alias added: GHSA-qq79-x2qm-v335

References

Exploit 1

Advisory 1

Other 1

  • TI-2024-22363 Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via… CVSS 3.1HIGH 8.8
  • TI-2024-16879 User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server… CVSS 3.1MEDIUM 5.3
  • TI-2024-16877 In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator… CVSS 3.1MEDIUM 6.7
  • TI-2025-11733 Failure in Password Rotation and Check-in Mechanism in Secret Server Allows Reuse of Credentials CVSS 4.0MEDIUM 5.3
  • TI-2024-16881 Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4… CVSS 3.1MEDIUM 4.3
  • TI-2024-16880 Improper authentication in Delinea Secret Server CVSS 3.1HIGH 8.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences