Stack-Based Buffer Overflow and Missing Authorization in Thales Sentinel Keys Server on Windows
CVE-2026-78403

9.3CRITICAL

Key Information:

Vendor

Thalesgroup

Status
Sentinel Keys Server
Vendor
CVE Published:
30 October 2026

What is CVE-2026-78403?

The Thales Sentinel Keys Server on Windows contains a stack-based buffer overflow and missing authorization vulnerability. This flaw allows an attacker to craft a malicious HTTP request that exceeds expected limits, potentially leading to remote code execution with system-level access, specifically as NT AUTHORITY\SYSTEM. All versions of Sentinel Keys Server prior to 1.3.8.0 are susceptible, emphasizing the need for immediate updates to enhance security measures.

Affected Version(s)

Sentinel Keys Server Windows 0 < 1.3.8.0

References

https://supportportal.thalesgroup.com/csm?id=kb_article_v...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matt Hetelson (matthew.hetelson@revolutional.com)
.