CVE-2025-12811 Cloud Suite and Privilege Access Service– HTTP request smuggling vulnerability
Attackers can exploit HTTP request smuggling in Delinea Cloud Suite to bypass security controls or access sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12811?
CVE-2025-12811 is a medium-severity vulnerability in Delinea Inc. Cloud Suite and Privileged Access Service, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service.
If you're not using the latest Server Suite agents, this fix requires that you upgrade to Server Suite 2023.1 (agent 6.0.1) or later. * If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:
* Server Suite release 2023.0.5 (agent version 6.0.0-158)
* Server Suite release 2022.1.10 (agent version 5.9.1-337)
Weakness: CWE-444
Which versions are affected by CVE-2025-12811?
How do I fix CVE-2025-12811?
No fix has been published for CVE-2025-12811 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12811 being exploited?
There is no known exploitation of CVE-2025-12811 in the wild and no public exploit code.
Sources
Also known as GHSA-654q-5mj4-74h4.