---
id: "CVE-2026-78403"
kind: "vulnerability"
aliases: ["CVE-2026-78403"]
title: "Thales Sentinel Keys Server: HTTP request overflow allows remote code as SYSTEM on Windows"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["sentinel-keys-server", "thales", "vendor", "windows"]
not_affected_if: ["fixed-version-1.3.8.0-or-later"]
published_at: "2026-10-30T20:17:17+00:00"
first_seen_at: "2026-10-30T20:25:39+00:00"
updated_at: "2026-10-30T20:26:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78403", "first_seen_at": "2026-10-30T20:25:39+00:00"}]
---

# Thales Sentinel Keys Server: HTTP request overflow allows remote code as SYSTEM on Windows

Thales Sentinel Keys Server on Windows does not check the length of the first field in an HTTP request, so a crafted request overflows a stack buffer. An unauthenticated attacker can run code as NT AUTHORITY\SYSTEM on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Sentinel Keys Server version against the affected range; `unknown` for the exact command in the sources
- Confirm whether the server is reachable from networks outside the host or LAN; `unknown` for the port in the sources

## Fix

- Sentinel Keys Server: move to `1.3.8.0` or later

## Timeline

- 2026-10-30T20:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78403

## From the sources

Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server. It may lead to remote code execution as NT
AUTHORITY\SYSTEM.





This issue affects Sentinel Keys Server:
versions lower than 1.3.8.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_