---
title: Thales Sentinel Keys Server CVE-2026-78403 (CVSS 9.8): an unauthenticated HTTP request can overflow the stack and run code as SYSTEM; update to 1.3.8.0 | ctxsec
url: https://ctxsec.com/items/thales-sentinel-keys-server-cve-2026-78403-unauth-rce-system
description: ""
status: "official (Thales PSIRT CVE record, Oct 30); no known exploitation"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/thales-sentinel-keys-server-cve-2026-78403-unauth-rce-system.md)

official (Thales PSIRT CVE record, Oct 30); no known exploitation

2026-10-30

### Thales Sentinel Keys Server CVE-2026-78403 (CVSS 9.8): an unauthenticated HTTP request can overflow the stack and run code as SYSTEM; update to 1.3.8.0

Thales's PSIRT published **CVE-2026-78403** on Oct 30 for **Sentinel Keys Server** on Windows, the license server used by software protected with Sentinel Keys dongles. The server doesn't check the length of the first field of an HTTP request, so a crafted request can cause a stack buffer overflow. No authentication is needed, and the result can be **remote code execution as NT AUTHORITY\SYSTEM**.

- **Affected:** all versions below **1.3.8.0**. **Fixed:** 1.3.8.0 (Thales KB0031216).
- **Scores:** CVSS 3.1 9.8, CVSS 4.0 9.3.
- **Exploitation:** none reported; not in CISA KEV.

License servers are often left reachable across flat engineering networks. Inventory hosts running Sentinel Keys Server, update them, and restrict the listener to the clients that need it.

Sources: [CVE-2026-78403 record (CNA: Thales PSIRT)](https://www.cve.org/CVERecord?id=CVE-2026-78403) · [Thales support KB0031216](https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216)