CVE-2026-78403: Buffer Overflow in Thales Sentinel Keys Server

CVE-2026-78403 identifies a stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows. The service fails to validate the length of the first field in HTTP requests, allowing an attacker to send crafted HTTP requests to achieve remote code execution (RCE) with NT AUTHORITY\SYSTEM privileges.

The vulnerability is classified as Critical with a CVSS score of 9.8. Published on October 30, 2026 on the NVD, the flaw affects all Sentinel Keys Server versions lower than 1.3.8.0. An official patch is already available. Social media signals over the last 24 hours reference the CVE and published CVSS score consistently.

Immediately verify the version of Sentinel Keys Server deployed in your environments. If below 1.3.8.0, schedule an upgrade to 1.3.8.0 or later as a priority action. Monitor access to the service and restrict the network perimeter from which it is reachable. Given the critical severity level, the patch must be applied without delay.