Delinea puts runtime control at the heart of agentic AI adoption at GITEX GLOBAL 2026. Delinea, the identity security platform that continuously controls what AI agents, humans and machines can do and for how long, today announced its participation at GITEX GLOBAL 2026. Under the theme "From Access to Action: Governing AI at Runtime", the company will demonstrate how organisations can put enforceable controls behind their AI ambitions, reducing the risk of rogue actions, while giving businesses the confidence to deploy autonomous agents across critical systems. In recent research, 98% of UAE respondents admitted that their organisations had experienced confirmed or suspected instances in which an AI tool accessed sensitive data beyond what its task required. Concerningly, only 16% said they could immediately revoke an AI tool's credentials and terminate its session, highlighting the gap between granting access and retaining control. These findings come as regional frameworks, including Saudi Arabia's National Cybersecurity Authority Essential Cybersecurity Controls (NCA ECC) and UAE government cybersecurity standards, reinforce the need for effective, auditable access controls. Through its participation, Delinea will show how runtime authorisation can help organisations apply these principles to autonomous agents by enforcing policy at the moment of action. UAETravel Guide Discover more Financial news subscription UAE business directory "This year has challenged regional organisations to build resilience against unexpected disruption while responding to AI-enabled threats and the shift from conversational AI to agents that act across business systems," said Mortada Ayad, VP - META, Delinea. "These monumental shifts create opportunities to automate more complex work, but also make control over autonomous actions essential. GITEX's December timing gives leaders the opportunity to reflect on these pressures and decide what they need to move forward. Identity security and runtime authorisation give them a foundation for that transition by empowering them to know who or what is acting, limit actions to the task, and retain the ability to intervene." LearnAI Tools Runtime authorisation will be at the centre of Delinea's product demonstrations, showing how the Delinea Platform brings together enterprise privileged access management and just-in-time controls for cloud-native and DevOps environments. At dedicated demo stations, visitors will explore Secret Server, privileged access management and identity threat detection, to understand how to discover identities, assess their access and reduce reliance on standing credentials. The platform's Cedar-based policy engine enforces least privilege throughout the session, translating access policies into controls that limit what an identity can do and for how long. Building on these capabilities, the demonstrations will show how runtime authorisation extends control to AI agents working across databases, SSH hosts, Kubernetes clusters and cloud consoles. Visitors will see how task-scoped access and real-time policy enforcement can allow, block or escalate an action before it executes, helping address the excessive access identified in Delinea's research. The focus of these product showcases will be on helping teams govern agent activity, as it happens, alongside the credential and session controls needed to intervene when access must end. LearnAI Tools "As CISOs and IT decision makers shape their 2027 budgets, GITEX is an opportunity to translate the year's lessons into practical conversations with security partners such as Delinea. It's not just an exercise in defence, but an opportunity to explore how security can enable the next growth stage of the business. If leaders are being asked to deliver agentic AI outcomes, they need to understand how to give agents enough freedom to do useful work while retaining the ability to govern their actions. We look forward to welcoming visitors to our stand and helping them turn those ambitions into a practical plan for secure AI adoption," said Ayad. LearnAI Tools Delinea will be present at stand H9-C30 during GITEX GLOBAL, taking place from 8-11 December 2026 at Dubai Exhibition Centre, Expo City Dubai. Middle East News 247 produces the latest news for the Middle East region, with a key focus on the GCC nations: UAE, Saudi Arabia, Qatar, Bahrain, Kuwait, and Oman. Contact News Desk: [email protected] Follow Me:

Delinea Secret Server auth bypass: why the FIDO2 hotfix isn't enough. Four critical flaws hit on-prem Delinea Secret Server, and Delinea says customers have reported attacks through one of them. The hotfixes fix one, and 12.2.7 now has newer flaws of its own. Here's how to upgrade and what to check. the ideaGet to 12.3.000002, check the keys on file, then fence the login. after reading, you can * Work out whether your Secret Server is still exposed, even after someone on the team applied the hotfix * Plan the upgrade to 12.3.000002 or later, including step upgrades and the changes that break scripts * Find FIDO2 keys nobody can explain, and reset them properly instead of just switching FIDO2 off Delinea has disclosed four critical flaws in on-premises Secret Server, two of which let someone sign in as another user, and it says customers have reported attacks through one of them. If you run Secret Server yourself, go to 12.3.000002 or later. 12.2.7 is the first build that closes these four, but newer flaws affect it. The quick hotfixes Delinea offered for the FIDO2 bug leave the other three open, and that's an easy gap to miss. Update, November 6: 12.2.7 isn't the place to stop any more. Delinea has since published three more Secret Server flaws that affect 12.2.7 and earlier, and the worst now scores 9.9. We've changed the upgrade advice below to 12.3.000002 and written up the new login bypass and what to check separately. The details of the four September flaws haven't changed. Correction, November 6: Earlier versions of this post said nobody had reported attacks. That was wrong. Delinea's Trust Center has carried a notice since October 1 saying customers report active exploitation of CVE-2026-19117, and we relied on CISA's records and Delinea's advisory page and missed it. If our old wording led you to put this off, move it up and check your FIDO2 registrations today. A PAM vault is the most valuable box on most networks. Whoever can sign in as an admin there can usually read the domain admin password, and from there reach almost anything. So a bug that lets an outsider become another user on Secret Server is about as bad as identity bugs get. Treat the FIDO2 flaw as under attack. Delinea's Trust Center says customers have reported active exploitation of their on-prem servers through CVE-2026-19117, and that notice has been up since October 1. It doesn't say how many customers or what the attackers did next. You won't see this in CISA's data: the flaw isn't on the Known Exploited Vulnerabilities list (we checked catalog 2026.11.04), and CISA's note on the CVE record still says exploitation none. Don't take either as an all-clear. CISA also marks the flaw as automatable, so an attacker could script it against many servers. We found no such reports for the other three. The scores need one caution. Delinea scored the FIDO2 bug with CVSS v3.1 and the other three with CVSS v4.0, so a 9.8 and a 9.5 aren't directly comparable. The v4 vectors for the SAML and padding oracle bugs say the attack is harder to pull off and needs certain conditions to be present. The XSS bug needs a user to click a crafted link. None of that makes them safe to leave. It tells you which one to worry about first if you can only do one thing tonight: the FIDO2 one. For engineers, the 12.2.7 release notes give a few more clues without naming the CVE. They list fixes to the FIDO2 two-factor registration callback, including tighter validation, a corrected challenge comparison and a longer life for the one-time registration key. A wrong challenge comparison is the kind of bug that lets a registration ceremony meant for one session complete for another. Treat that as our reading of the notes, since Delinea hasn't confirmed the root cause. In Secret Server, FIDO2 is a second factor that comes after the password. That's why this bug is ugly. The key is supposed to be the thing that saves you when a password leaks, and here the key itself was the weak spot. It also matters for cleanup, which we come back to in the playbook: a rogue key stays on the account until someone resets it. Delinea fixed the FIDO2 bug first, and quietly. Secret Server 12.1.000003 went out with a line saying it fixed CVE-2026-19117, and that details were held back so customers could update before they went public. The CVE record followed about three weeks later, and it lists hotfixes for older lines too. The other three CVEs were published on September 15 and are only fixed in 12.2.7 and later (the XSS bug is also fixed from 12.0.20). The four Secret Server CVEs at a glance. Here's the trap. If your team saw the FIDO2 advisory, took the hotfix for its line and closed the ticket, the job isn't done. The 12.1.3 hotfix fixes FIDO2, but the SAML and padding oracle bugs affect every version from 10.5 up to and including 12.1.3. The 11.9.48 hotfix leaves those two open and the XSS bug as well, since that one runs through 11.9.48. If your server sits on any of those hotfix builds, at least two of the four are still open, and three on 11.9.48 or older. One cell in that table deserves a footnote you won't find in the advisory. The XSS fix is listed as 12.0.20 or later, but Delinea withdrew 12.0.000020 and 12.0.000021 from distribution, and told customers with an HSM whose server failed after that upgrade to roll back to 11.9.000047. If you're on a 12.0 build, check which one, and plan the move to 12.2.7 or later instead of stopping on 12.0. How it unfolded. What to do now, by who you are. If you only get one check done today, make it the FIDO2 registrations. Each Secret Server user can have one FIDO2 device registered at a time, so a list of registrations is short and easy to read. Any key registered to an admin account that the admin can't account for is a reason to treat the server as compromised. The upgrade order that works on-prem. Secret Server has had seven on-prem advisories in about fifteen months on Delinea's own page, and four of them were critical. Plan for more. The goal is that the next login bug costs you an upgrade night and nothing else, because nobody outside your staff networks can reach the login page and a stolen login still can't see much. Two of these do most of the work. Getting the login page off the internet turns three of the four CVEs from a remote problem into an insider problem, and the fourth needs someone on your staff to click a link. Alerting on FIDO2 registrations costs almost nothing, because real registrations are rare and each one should match a ticket or a new hire. One newer fix is worth using while you're in there. Since 12.3.000001, SAML certificate additions and replacements show up in the SAML audit log. Swapping the identity provider certificate is a classic way to make forged sign-ins look valid, so forward that log too. Work through these in order. The two mistakes to avoid are disabling FIDO2 instead of resetting it, and rotating passwords before the attacker's access is gone. A word on the padding oracle bug, because it changes what you look for. Delinea says the server's key isn't exposed, but an attacker could decrypt or encrypt data with it. Microsoft's guidance on this class of bug describes the attacker decrypting a message byte by byte by sending slightly changed versions and watching how the server responds. That takes a lot of requests. A burst of thousands of failed requests from one address, sitting in IIS logs that nobody watches, is the thing to search for. What this could look like: three typical setups. These three are made up. None of them is a real incident or a Cohash client. They're here to show how the same advisory plays out differently depending on where Secret Server runs and which build it's on. We implement and upgrade Delinea Secret Server, including the step upgrades, distributed engines and launchers that make these jobs slow. If you want a second pair of hands for the move to 12.3.000002 or later, or a review of who can see what in your vault afterwards, start with our Delinea page, look at Delinea engineers you can bring in, or take the free assessment to see where your privileged access stands. fact-checked November 2026 against vendor and official documentation · where to go next 01Am I affected by CVE-2026-19117? If you run Secret Server on your own servers at a version from 10.6.0 up to 12.1.2 and haven't applied one of Delinea's hotfixes, yes. The hotfixed builds are 12.1.3, 12.0.23, 11.9.48, 11.8.2 and 11.7.62, and 12.2.7 or later fixes it too. Delinea's cloud service isn't affected. 02We applied the FIDO2 hotfix when it came out. Are we done? 03We're on Secret Server Cloud. Do we have to do anything? 04Has anyone exploited these? 05Should we upgrade to 12.2.7 or straight to 12.3? 06We don't use FIDO2 keys. Does the FIDO2 bug still matter? 07Our version is older than 11.7. What now? * Q1Your on-prem Secret Server runs the 12.1.3 hotfix you applied in September, and staff sign in through SAML. What's your status? show the answer * Q2An admin swears they never registered the FIDO2 key that's on their Secret Server account. What do you do about the key? show the answer * Q3You moved to Secret Server Cloud last year and the old on-prem server was supposedly switched off. What's worth checking? show the answer