Thales's PSIRT published CVE-2026-78403 on Oct 30 for Sentinel Keys Server on Windows, the license server used by software protected with Sentinel Keys dongles. The server doesn't check the length of the first field of an HTTP request, so a crafted request can cause a stack buffer overflow. No authentication is needed, and the result can be remote code execution as NT AUTHORITY\SYSTEM.

• Affected: all versions below 1.3.8.0. Fixed: 1.3.8.0 (Thales KB0031216).
• Scores: CVSS 3.1 9.8, CVSS 4.0 9.3.
• Exploitation: none reported; not in CISA KEV.

License servers are often left reachable across flat engineering networks. Inventory hosts running Sentinel Keys Server, update them, and restrict the listener to the clients that need it.