Delinea's cloud-native identity security platform serves as the central control plane for managing access across human, machine, third-party, and AI identities. By continuously discovering identities, assessing risk, and enforcing least-privilege access in real time, Delinea transforms identity from an organization's greatest vulnerability into its strongest line of defense.
Security is built into everything we do. Delinea maintains a comprehensive Information Security Program aligned to industry-recognized frameworks and designed to protect the confidentiality, integrity, and availability of our systems and customer data. Delinea implements a robust security program that embeds security controls and continuous quality assurance at every stage of the development lifecycle. The safeguards encompass intrusion detection, DDoS prevention, vulnerability management, behavioral analytics, continuous monitoring, cryptographic protections, network security, and configuration management, ensuring our platform remains resilient against evolving threats.
Trust Center Updates
Update on Brotli vulnerability affecting NodeJS CVE-2026-111497 (Node2Shell)
Delinea is aware of the critical vulnerability in Google's widely-used Brotli decoder that can allow attackers to compromise applications. The vulnerable component is notably included in the NodeJS runtime used by many web applications.
One Delinea offering, Identity Threat Protection and Response (ITDR) was identified as affected and promptly updated on October 25. No evidence of exploitation has been discovered. All other Delinea product and services do not use Node.js in a web server context and are not affected by the vulnerabilities.
Update on eMudhra compromised CA CVE-2026-108014, CVE-2026-115570 and other related CVE's
Delinea is aware that eight private keys for a widely used Certificate Authority (CA), eMudhra, have been compromised. This affects all applications, operating systems and web browsers that include trust for these certificates.
One Delinea offering, StrongDM, was identified as impacted. An updated version that protects against this vulnerability is in deployment to all update channels. No action is needed from customers that have automatic updates enabled. For those with automatic updates disabled, StrongDM should be updated if the Desktop Application is a version less than 25.2.0, or if the CLI is a version less than 55.99.1.
All other Delinea products and services do not include trust for eMudhra certificates and are not directly affected by the vulnerabilities.
External dependencies: Software applications may be indirectly affected if they depend on Operating Systems, browsers, or other platform elements that are vulnerable. Users should consider updating any systems or software components that are vulnerable to this set of CVE's.
Update on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell)
Delinea is aware of the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, collectively known as “php2shell,” which were disclosed on Wednesday, October 21, 2026. One legacy Delinea offering, ideiio was identified as affected and promptly updated within hours of the public disclosure. No action is needed from customers. Investigations found no evidence of exploitation. All other Delinea product and services do not use PHP and are not affected by the vulnerabilities. [Updated with information about ideiio.]
Exploitation of Secret Server on-prem deployments via CVE-2026-19117
Delinea has received reports of customers observing active exploitation of their on-prem Secret Server instances via CVE-2026-19117.
Delinea would like to remind customers that they are highly encouraged to upgrade their Secret Server on-prem to a version that addresses CVE-2026-19117. as described in the advisory.
Delinea Secret Server on-prem FIDO2 credential registration authentication bypass vulnerability - CVE- 2026-19117
Vulnerability Description - Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
Affected product and version
Delinea Secret Server on-prem
10.6.0 through 11.7.61
11.8.0 through 11.8.1
11.9.0 through 11.9.47
12.0.0 through 12.0.22
12.1.0 through 12.1.2
Resolution
Upgrade to secret server version 12.2.7 or later, or upgrade to one of the following hotfixes: 12.1.3, 12.0.23, 11.9.48, 11.8.2, or 11.7.62.
Customers on versions prior to 11.7 should upgrade to a supported version to address this vulnerability
CVE Details
- CVE ID - CVE-2026-19117
- Published Date: September 2, 2026
- Vulnerability Type: Authentication bypass by spoofing
- CWE: 290
- CVSS V3 Score: 9.8
- CVSS V3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- References: (https://docs.delinea.com/online-help/secret-server/release-notes/ssvr-onprem-rn.htm)