CVE-2026-15638 is a newly disclosed flaw in Secret Server where an unauthenticated user with access to the server can exploit a padding oracle to decrypt or encrypt data protected by one of its cryptographic keys. The key material itself is never exposed by the flaw, but the oracle still gives an attacker a way to manipulate protected data without logging in. NVD published the advisory on September 16, 2026.
// source: nvd.nist.gov ↗