Live › vulnerability › CVE-2026-78403
Thales Sentinel Keys Server on Windows does not check the length of the first field in an HTTP request, so a crafted request overflows a stack buffer. An unauthenticated attacker can run code as NT AUTHORITY\SYSTEM on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Sentinel Keys Server installations on Windows running a version lower than 1.3.8.0 are affected. The description names no required setting or account, so any reachable instance should be treated as exposed until it is confirmed on a fixed version.
No product ranges from the sources yet.
unknown for the exact command in the sourcesunknown for the port in the sources1.3.8.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM.
This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-78403")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.