{"id":"CVE-2026-78403","state":"PUBLISHED","title":"Unauthenticated Stack Buffer Overflow in Sentinel Keys Server","description":"Stack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\n\n\n\n\n\nThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0.","publishedAt":"2026-10-30T19:12:56.080Z","updatedAt":"2026-10-30T20:02:33.210Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"THA-PSIRT"},"assigner":"THA-PSIRT","products":["Thalesgroup Sentinel Keys Server"],"affected":[{"vendor":"Thalesgroup","product":"Sentinel Keys Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.8.0","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216"],"weaknesses":["CWE-121","CWE-862"],"ingestedAt":"2026-10-30T20:14:06.645Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/78xxx/CVE-2026-78403.json","commit":"d7f5c3fe206091a44e450f13bfe51dc81b8a7843","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-78403","state":"PUBLISHED","datePublished":"2026-10-30T19:12:56.080Z","dateUpdated":"2026-10-30T20:02:33.210Z","assignerShortName":"THA-PSIRT","assignerOrgId":"9d5917ae-205d-4ae5-8749-1f49479b1395","dateReserved":"2026-08-24T14:22:05.425Z"},"containers":{"cna":{"title":"Unauthenticated Stack Buffer Overflow in Sentinel Keys Server","descriptions":[{"lang":"en","value":"Stack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\n\n\n\n\n\nThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0."}],"affected":[{"vendor":"Thalesgroup","product":"Sentinel Keys Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.8.0","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-121","lang":"en","description":"CWE-121 Stack-based buffer overflow","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"THA-PSIRT","orgId":"9d5917ae-205d-4ae5-8749-1f49479b1395","dateUpdated":"2026-10-30T19:48:32.603Z"},"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"1.3.8.0"}]}]}],"solutions":[{"lang":"en","value":"Upgrade to latest version.","supportingMedia":[{"type":"text/html","base64":false,"value":"Upgrade to latest version."}]}],"credits":[{"lang":"en","value":"Matt Hetelson (matthew.hetelson@revolutional.com)","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T19:59:29.771309Z","id":"CVE-2026-78403","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-30T20:02:33.210Z"}}]}}}