An unauthenticated user with access to Secret Server can leverage a padding oracle vulnerability to decrypt or encrypt data using one of the server's cryptographic keys. The cryptographic key itself is not disclosed by the attack. The vulnerability is identified as CWE-327 and has a critical severity rating. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker can decrypt or encrypt data using the server's cryptographic keys without authentication, potentially compromising the confidentiality and integrity of sensitive data managed by Secret Server. The cryptographic key itself is not exposed, but the ability to perform cryptographic operations could allow manipulation or disclosure of protected information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data.