From their release document:

• If the attackers place a network sniffer on a customer’s internal network and have access to the encryption details, the pcAnywhere traffic – including exchanged user login credentials – could be intercepted and decoded.
• If the attackers get their hands on the cryptographic key they can launch remote control sessions and, thus, access to systems and sensitive data. If the cryptographic key itself is using Active Directory credentials, they can also carry out other malicious activities on the network. [emphasis added]

Frankly, I’ve not been particularly fond of single-signon solutions, such as Active Directory, just because of these types of problems.

Link: HELP-NET SECURITY – Symantec advises customers to stop using pcAnywhere