Thales Sentinel Keys Server Remote Code Execution (CVE-2026-78403)
An unauthenticated stack-based buffer overflow in Thales Sentinel Keys Server allows remote attackers to achieve code execution with SYSTEM privileges by sending a maliciously crafted HTTP request.
CVE search metadata
CVE search record: CVE-2026-78403. Severity: critical. CVSS: 9.8. KEV: no. Product: Sentinel Keys Server (< 1.3.8.0). Brief: Thales Sentinel Keys Server Remote Code Execution (CVE-2026-78403). Brief link: https://feed.craftedsignal.io/briefs/2026-10-sentinel-keys-rce/
Triage facts
Revision 1- Applicability
- Sentinel Keys Server (< 1.3.8.0)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 30, 23:04 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
Thales Sentinel Keys Server is affected by a stack-based buffer overflow vulnerability (CVE-2026-78403) due to improper length validation of the first field in incoming HTTP requests. An unauthenticated attacker can exploit this via the network to execute arbitrary code as NT AUTHORITY\SYSTEM. This vulnerability affects Sentinel Keys Server versions prior to 1.3.8.0.
Impact
Successful exploitation grants an attacker full remote code execution on the underlying Windows system with SYSTEM-level privileges.
Recommendation
- Update Thales Sentinel Keys Server to version 1.3.8.0 or later immediately.
- Until patching, restrict network access to the Sentinel Keys Server service to authorized administrative IP addresses only.
- Review web server access logs for anomalous, high-length HTTP request headers or unusually long request lines directed at the service.
Immediate actions
Patch Sentinel Keys Server to 1.3.8.0 or later
Threat Hunt
Identify abnormally large HTTP requests directed at Sentinel Keys Server service ports
Data: Web server access logs, Network traffic logs (URI length/header size)
Mitigations
Apply network ACLs to restrict service access
Sentinel Keys Server network exposure