Delinea Fixes Flaw, But Only After Analyst Goes Public With Disclosure First

A researcher disclosed a critical authentication/authorization vulnerability in Delinea's Secret Server SOAP API after reporting it to the vendor and working with CERT; Delinea subsequently rolled out an automatic cloud fix and an on‑premises patch. The report highlights delayed or restricted vendor intake for external researchers (researcher was told he couldn't open a case because he wasn't a paying customer), lack of an assigned CVE at the time, and broader strain on vulnerability management processes across the industry.