Thales Sentinel Keys Server unauthenticated RCE as SYSTEM (CVE-2026-78403), fixed in 1.3.8.0

Thales published two CVEs on Oct 30 2026 for Sentinel Keys Server on Windows, the license server used with Sentinel Keys software protection. CVE-2026-78403 (CVSS 4.0 9.3 critical) is a stack-based buffer overflow with missing authorization: the server doesn't check the length of the first field in an HTTP request, so an unauthenticated remote attacker can send a crafted request that may lead to code execution as NT AUTHORITY\SYSTEM. CVE-2026-78402 (CVSS 4.0 7.3 high) is a similar unchecked first field in local input messages that allows local privilege escalation to SYSTEM. Both affect versions lower than 1.3.8.0. No exploitation has been reported so far.

Why this severity: CVSS 4.0 9.3 (Thales PSIRT): network, no authentication, no user interaction, code runs as SYSTEM; no exploitation reported yet

Started

Oct 30, 2026

CVEs

CVE-2026-78403CVE-2026-78402

• #Thales
• #Sentinel Keys
• Windows
• RCE
• #Unauthenticated
• #Buffer Overflow
• #Privilege escalation

Notes & caveats

Thales's own advisory sits behind a support-portal login, so details here come from the CVE records Thales PSIRT published.