CriticalCritical vulnerability
CVE-2026-15640 (CVSS 9.5)
NVD · officialPublished Sep 16, 2026Risk 50/100EPSS 0.3%
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.
Technical details
CVSS
9.5
AV:NetworkAC:HighPR:NoneUI:None
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source