Thales Sentinel Keys Server Unauthenticated Stack Buffer Overflow (CVE-2026-78403)

The CVE record says Sentinel Keys Server "does not check the length of the first field in the HTTP request." An attacker can send a crafted request that overflows a buffer on the stack. Thales says this may lead to remote code execution as NT AUTHORITY\SYSTEM on Windows.

Thales titles the record "Unauthenticated Stack Buffer Overflow in Sentinel Keys Server." It lists two weaknesses: a stack-based buffer overflow (CWE-121) and missing authorization (CWE-862). By the record, the request needs no login and the code runs with SYSTEM rights.

How Severe Is It?

Thales PSIRT is the CVE numbering authority (CNA) for this flaw and scores it twice. The CVSS 3.1 score is 9.8 Critical and the CVSS 4.0 score is 9.3 Critical. Both vectors say the attack runs over the network, with low complexity, no privileges and no user action.

CISA's SSVC entry of 30 October records exploitation as none, automatable as yes and technical impact as total. NVD had not added its own score when we checked on 31 October. Our CVSS glossary entry explains how these scores are built.

Why the Advisory Is Hard to Read

The CVE record points to one vendor advisory, article KB0031216 on the Thales support portal. When we opened it on 31 October, the portal marked it as a secured article that asks for a login. The public facts on this page therefore come from the CVE record, which Thales wrote as the CNA.

The record gives one fix line: "Upgrade to latest version." It does not describe a workaround, a default port or which Thales products install the server. Customers with a support account can read the full article.

An Old Target

Two earlier CVE records, from the SafeNet era, also name Sentinel Keys Server. CVE-2007-6483 lets remote attackers read arbitrary files with a dot dot sequence in the query string. CVE-2008-0760 does the same through the URI, and its record calls it an incomplete fix for the first flaw.

Those flaws let attackers read files. CVE-2026-78403 also arrives as an HTTP request to the server, but the record says it can run code. A server that other networks can reach is the first one to check.

What Our Checks Showed

These are the public signals we checked on 31 October 2026.

The X and Blackhole posts repeat the CVE record and add no new detail. Thales does not say in the public record whether anyone has exploited the flaw. Our glossary explains what remote code execution means for a host.

The CVE record lists one product and one platform: Sentinel Keys Server on Windows. Every version lower than 1.3.8.0 is affected, and the record marks every other version as unaffected. Thales advises an upgrade to the latest version.

The record does not name a download page. Thales points customers to the secured support article KB0031216. Admins who cannot open it should ask Thales support for the fixed build.

Thales published a second record the same day, CVE-2026-78402, a local stack buffer overflow in the same product with the same affected range below 1.3.8.0. By the two records, version 1.3.8.0 or later is outside both affected ranges.

Check each Windows host for the service, not only the license servers you already know about. Our vulnerability management guide covers how to find and track such installs.