CVE-2014-4861

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-03-09 · updated 2026-06-17
Weakness: CWE-255

Description

The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a session has ended.

Affected products

Thycotic Secret Server: from 7.5.000000 through 8.6.000009

References

http://thycotic.com/products/secret-server/resources/advisories/cve-2014-4861/
http://thycotic.com/products/secret-server/resources/advisories/cve-2014-4861/

Get alerted when CVE-2014-4861 or the next vulnerability affects your stack