Thales Sentinel Keys Server unauthenticated RCE as SYSTEM (CVE-2026-78403), fixed in 1.3.8.0 ยท updates https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403 Thales published two CVEs on Oct 30 2026 for Sentinel Keys Server on Windows, the license server used with Sentinel Keys software protection. CVE-2026-78403 (CVSS 4.0 9.3 critical) is a stack-based buffer overflow with missing authorization: the server doesn't check the length of the first field in an HTTP request, so an unauthenticated remote attacker can send a crafted request that may lead to code execution as NT AUTHORITY\SYSTEM. CVE-2026-78402 (CVSS 4.0 7.3 high) is a similar unchecked first field in local input messages that allows local privilege escalation to SYSTEM. Both affect versions lower than 1.3.8.0. No exploitation has been reported so far. en Fri, 30 Oct 2026 00:00:00 GMT Thales Sentinel Keys Server unauthenticated RCE as SYSTEM (CVE-2026-78403), fixed in 1.3.8.0: Thales PSIRT publishes CVE-2026-78403 (unauthenticated HTTP stack overflow, RCE as SYSTEM, CVSS 4.0 9.3) and CVE-2026-78402 (local stack overflow, privilege escalation to SYSTEM, CVSS 4.0 7.3) for Sentinel Keys Server below 1.3.8.0. https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403 https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403#2026-10-30-1a96b6da Fri, 30 Oct 2026 00:00:00 GMT critical <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-78403">Source</a></p>