CVE-2026-78403CWE-121CWE-862broken-access-control

Unauthenticated Stack Buffer Overflow in Sentinel Keys Server

Critical · published October 30, 2026

CVSS v3.1
9.8
EPSS
—
In the wild
Unconfirmed
What it is

Stack-based buffer overflow and missing

authorization vulnerability in Thales Sentinel Keys Server on Windows allows

Overflow Buffers. Sentinel Keys Server does not check the length of the first

field in the HTTP request. An attacker may craft an HTTP request and send it to

Sentinel Keys Server. It may lead to remote code execution as NT

AUTHORITY\SYSTEM.

This issue affects Sentinel Keys Server:

versions lower than 1.3.8.0.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
Not scored
Weaknesses
CWE-121 · Stack-based Buffer Overflow; CWE-862 · Missing Authorization
Published
2026-10-30T19:12Z
Timeline
  • 30 OCT 19:12Z
    Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
    cvelistv5
  • 30 OCT 19:12Z
    Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
    cvelistv5