{"id":"CVE-2026-78403","kind":"vulnerability","aliases":["CVE-2026-78403"],"related":[],"title":"Thales Sentinel Keys Server: HTTP request overflow allows remote code as SYSTEM on Windows","description":"Stack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\n\n\n\n\n\nThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0.","summary":"Thales Sentinel Keys Server on Windows does not check the length of the first field in an HTTP request, so a crafted request overflows a stack buffer. An unauthenticated attacker can run code as NT AUTHORITY\\SYSTEM on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["sentinel-keys-server","thales","vendor","windows"],"not_affected_if":["fixed-version-1.3.8.0-or-later"],"how_to_check":"- Check the installed Sentinel Keys Server version against the affected range; `unknown` for the exact command in the sources\n- Confirm whether the server is reachable from networks outside the host or LAN; `unknown` for the port in the sources","fix":"- Sentinel Keys Server: move to `1.3.8.0` or later","status":"open","published_at":"2026-10-30T20:17:17+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","triaged_at":"2026-10-30T20:26:06+00:00","updated_at":"2026-10-30T20:26:06+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-30T20:26:06Z","model":"claude-haiku-5-5","output":{"fix":"- Sentinel Keys Server: move to `1.3.8.0` or later","reach":"network","title":"Thales Sentinel Keys Server: HTTP request overflow allows remote code as SYSTEM on Windows","impact":"high","summary":"Thales Sentinel Keys Server on Windows does not check the length of the first field in an HTTP request, so a crafted request overflows a stack buffer. An unauthenticated attacker can run code as NT AUTHORITY\\SYSTEM on the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["windows","thales","sentinel-keys-server"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs code as SYSTEM on the Windows server","analyst_note":"Confirm the affected version range, default port and whether the flaw is reachable from the internet, using the Thales advisory and the NVD entry.","how_to_check":"- Check the installed Sentinel Keys Server version against the affected range; `unknown` for the exact command in the sources\n- Confirm whether the server is reachable from networks outside the host or LAN; `unknown` for the port in the sources","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version-1.3.8.0-or-later"],"who_is_affected":"Sentinel Keys Server installations on Windows running a version lower than 1.3.8.0 are affected. The description names no required setting or account, so any reachable instance should be treated as exposed until it is confirmed on a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000709,"input_tokens":4202,"output_tokens":577,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-78403':17A,20A '1.3.8.0':137C 'affect':130C 'allow':8A,84C 'attack':57B,104C 'author':63B,75C,126C 'base':70C 'buffer':54B,71C,86C 'check':36B,92C 'code':10A,60B,122C 'craft':49B,106C 'cve':15A,18A 'execut':123C 'field':42B,98C 'first':41B,97C 'http':5A,45B,101C,108C 'issu':129C 'key':3A,23B,30B,80C,88C,115C,132C 'lead':119C 'length':38B,94C 'lower':135C 'may':105C,118C 'miss':74C 'nt':62B,125C 'overflow':7A,51B,72C,85C 'remot':9A,121C 'request':6A,46B,50B,102C,109C 'run':59B 'send':111C 'sentinel':2A,22B,29B,79C,87C,114C,131C 'sentinel-keys-serv':21B 'server':4A,24B,31B,67B,81C,89C,116C,133C 'stack':53B,69C 'stack-bas':68C 'system':12A,64B,127C 'thale':1A,25B,28B,78C 'unauthent':56B 'vendor':26B 'version':134C 'vulner':76C 'window':14A,27B,33B,83C","nicknames":[],"mitigations":[],"who_affected":"Sentinel Keys Server installations on Windows running a version lower than 1.3.8.0 are affected. The description names no required setting or account, so any reachable instance should be treated as exposed until it is confirmed on a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T20:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@thalesgroup.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78403","severity":null,"published_at":"2026-10-30T20:17:17+00:00","modified_at":"2026-10-30T20:17:17+00:00","first_seen_at":"2026-10-30T20:25:39+00:00","fetched_at":"2026-10-30T20:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}