9.8
CriticalCVSS 3.1 · from THA-PSIRT
CVE-2026-78403
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
Sentinel Keys Server · Stack buffer overflow · CWE-121AffectedSentinel Keys Server
FixUpdate to 1.3.8.0 or newer
PublishedOct 30, 19:12 · THA-PSIRT
ScoredOct 30 · 9.8 · THA-PSIRT
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.
From THA-PSIRT
Affected and fixed versions
ProductAffectedFixed inSentinel Keys Serverbefore 1.3.8.01.3.8.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known