This vulnerability involves the use of a broken or risky cryptographic algorithm (CWE-327) in Delinea Secret Server (On-Prem). An unauthenticated attacker with access to the server can leverage a padding oracle attack to decrypt or encrypt data with one of the server's cryptographic keys. Although the key is not exposed, the ability to perform cryptographic operations without authorization poses a significant security risk. The affected versions are from 10.5.1 up to and including 12.1.3. The CVSS 4.0 score is 9.1, indicating a critical severity with network attack vector, high complexity, and no privileges or user interaction required.

An unauthenticated attacker with access to the Secret Server can exploit the padding oracle vulnerability to decrypt or encrypt data using one of the server's cryptographic keys. This could lead to unauthorized cryptographic operations, potentially compromising the confidentiality and integrity of sensitive data managed by the server. The cryptographic key itself is not exposed, but the ability to manipulate encrypted data poses a serious security risk.

No explicit patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Secret Server to trusted users only and monitor for unusual cryptographic activity.