# Thales Sentinel Keys Server unauthenticated RCE as SYSTEM (CVE-2026-78403), fixed in 1.3.8.0 · pwn.watch

> Thales published two CVEs on Oct 30 2026 for Sentinel Keys Server on Windows, the license server used with Sentinel Keys software protection. CVE-2026-78403 (CVSS 4.0 9.3 critical) is a stack-based buffer overflow with missing authorization: the server doesn't check the length of the first field in an HTTP request, so an unauthenticated remote attacker can send a crafted request that may lead to code execution as NT AUTHORITY\SYSTEM. CVE-2026-78402 (CVSS 4.0 7.3 high) is a similar unchecked first field in local input messages that allows local privilege escalation to SYSTEM. Both affect versions lower than 1.3.8.0. No exploitation has been reported so far.

Page: https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403 · generated 2026-10-30T21:58:17.587Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Thales Sentinel Keys Server (Windows)
- Started: 2026-10-30
- CVEs: CVE-2026-78403, CVE-2026-78402
- Affected: Sentinel Keys Server on Windows, versions lower than 1.3.8.0
- Fixed in: Sentinel Keys Server 1.3.8.0

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403/feed.xml
- JSON Feed: https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403.json
- This file: https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403/llms.txt

## Updates (newest first)
- 2026-10-30: Thales PSIRT publishes CVE-2026-78403 (unauthenticated HTTP stack overflow, RCE as SYSTEM, CVSS 4.0 9.3) and CVE-2026-78402 (local stack overflow, privilege escalation to SYSTEM, CVSS 4.0 7.3) for Sentinel Keys Server below 1.3.8.0. (https://www.cve.org/CVERecord?id=CVE-2026-78403)

## Fix brief
# Security brief: Thales Sentinel Keys Server unauthenticated RCE as SYSTEM (CVE-2026-78403), fixed in 1.3.8.0

Source: https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403 · status: live · severity: critical · updated Oct 30, 2026, 19:44 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Thales published two CVEs on Oct 30 2026 for Sentinel Keys Server on Windows, the license server used with Sentinel Keys software protection. CVE-2026-78403 (CVSS 4.0 9.3 critical) is a stack-based buffer overflow with missing authorization: the server doesn't check the length of the first field in an HTTP request, so an unauthenticated remote attacker can send a crafted request that may lead to code execution as NT AUTHORITY\SYSTEM. CVE-2026-78402 (CVSS 4.0 7.3 high) is a similar unchecked first field in local input messages that allows local privilege escalation to SYSTEM. Both affect versions lower than 1.3.8.0. No exploitation has been reported so far.

Severity detail: CVSS 4.0 9.3 (Thales PSIRT): network, no authentication, no user interaction, code runs as SYSTEM; no exploitation reported yet

- Product: Thales Sentinel Keys Server (Windows)
- CVE / advisory ids: CVE-2026-78403, CVE-2026-78402

## Affected versions
- Sentinel Keys Server on Windows, versions lower than 1.3.8.0

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Sentinel Keys Server 1.3.8.0

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Find Windows machines running Sentinel Keys Server (often installed alongside software that uses Sentinel Keys licensing) and update it to 1.3.8.0 or later through Thales or the software vendor that ships it. Until then, block network access to the Sentinel Keys Server port from untrusted networks. Re-check NVD and news for a public PoC or exploitation.

## Latest updates
- Oct 30, 2026: Thales PSIRT publishes CVE-2026-78403 (unauthenticated HTTP stack overflow, RCE as SYSTEM, CVSS 4.0 9.3) and CVE-2026-78402 (local stack overflow, privilege escalation to SYSTEM, CVSS 4.0 7.3) for Sentinel Keys Server below 1.3.8.0.

## Advisories
- [CVE-2026-78403: Unauthenticated Stack Buffer Overflow in Sentinel Keys Server](https://www.cve.org/CVERecord?id=CVE-2026-78403) (CVE Program (Thales PSIRT))
- [CVE-2026-78402: Stack Buffer Overflow in Sentinel Keys Server](https://www.cve.org/CVERecord?id=CVE-2026-78402) (CVE Program (Thales PSIRT))
- [Thales support portal advisory KB0031216 (login required)](https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216) (Thales)

## Caveats
Thales's own advisory sits behind a support-portal login, so details here come from the CVE records Thales PSIRT published.

---
Machine-readable: https://pwn.watch/i/thales-sentinel-keys-server-unauth-rce-cve-2026-78403.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.