Zero Radar
← feed
CriticalVulnerabilityCVE-2026-78403updated 30 Oct 2026, 20:20 UTC

Thales Sentinel Keys Server on Windows can be taken over remotely

A flaw lets an outsider send a specially crafted web request to this license server and run their own code on it with full system control. Anyone who can reach the server over the network could potentially exploit it.

Fixed in Version 1.3.8.0 or later · out Official source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 1.3.8.0 or later · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted HTTP request with oversized field
  2. 2Request reaches serverServer does not check field length
  3. 3Buffer overflowsStack memory overwritten by attacker data
  4. 4Code runs as SYSTEMAttacker gains full control of the server
  5. ResultAttacker controls the Windows server

What happened

A stack-based buffer overflow and missing authorization in Thales Sentinel Keys Server on Windows: the server does not check the length of the first field in an HTTP request, allowing remote code execution as NT AUTHORITY\SYSTEM.

Why it is dangerous: Successful exploitation gives the attacker SYSTEM-level control of the Windows machine, which can lead to data theft, disruption, or use of the server as a foothold into the rest of the network.

Are you affected?

You are affected if you run Thales Sentinel Keys Server version lower than 1.3.8.0 on Windows.

Thales Sentinel Keys Server on Windows, all versions lower than 1.3.8.0

What to do

  1. Check your installed Sentinel Keys Server version and confirm whether it is lower than 1.3.8.0.
  2. Update Sentinel Keys Server to version 1.3.8.0 or later.
  3. Limit network access to the server so only trusted systems can reach it until patched.

Timeline

  1. 30 Oct 2026, 20:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 20:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 20:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-78403
CVSS
9.3 / 10
Disclosed
30 Oct 2026, 20:17 UTC
On Zero Radar
30 Oct 2026, 20:20 UTC (3 min after disclosure)
Last change
30 Oct 2026, 20:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Thales Sentinel Keys Server on Windows can be taken over remotely · Zero Radar