Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Sentinel Keys Server by Thalesgroup
CVE-2026-78403 (GCVE-0-2026-78403)
Vulnerability from nvd – Published: 2026-10-30 19:12 – Updated: 2026-10-30 20:02
VLAI
EPSS
VEX
Title
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
Summary
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server. It may lead to remote code execution as NT
AUTHORITY\SYSTEM.
This issue affects Sentinel Keys Server:
versions lower than 1.3.8.0.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 19:59 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Sentinel Keys Server |
Affected:
0 , < 1.3.8.0
(custom)
cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T19:59:29.771309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:02:33.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel Keys Server",
"vendor": "Thalesgroup",
"versions": [
{
"lessThan": "1.3.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "1.3.8.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Hetelson (matthew.hetelson@revolutional.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\u003c/p\u003e\n\n\u003cp\u003eThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0.\u003c/p\u003e"
}
],
"value": "Stack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\n\n\n\n\n\nThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:48:32.603Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61\u0026sysparm_article=KB0031216"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to latest version."
}
],
"value": "Upgrade to latest version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Stack Buffer Overflow in Sentinel Keys Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-78403",
"datePublished": "2026-10-30T19:12:56.080Z",
"dateReserved": "2026-08-24T14:22:05.425Z",
"dateUpdated": "2026-10-30T20:02:33.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78402 (GCVE-0-2026-78402)
Vulnerability from nvd – Published: 2026-10-30 19:11 – Updated: 2026-10-30 20:00
VLAI
EPSS
VEX
Title
Stack Buffer Overflow in Sentinel Keys Server
Summary
Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow
Buffers.
Sentinel Keys Server does not check the length of the first field in
the input message. A local attacker may craft an input and send it to Sentinel
Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling
local privilege escalation.
This issue affects Sentinel Keys Server: versions
lower than 1.3.8.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 20:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Sentinel Keys Server |
Affected:
0 , < 1.3.8.0
(custom)
cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78402",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T20:00:33.506955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:00:42.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel Keys Server",
"vendor": "Thalesgroup",
"versions": [
{
"lessThan": "1.3.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "1.3.8.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Hetelson (matthew.hetelson@revolutional.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSentinel Keys Server does not check the length of the first field in\nthe input message. A local attacker may craft an input and send it to Sentinel\nKeys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling\nlocal privilege escalation.\u003c/p\u003e\u003cp\u003e\n\nThis issue affects Sentinel Keys Server: versions\nlower than 1.3.8.0.\u003c/p\u003e"
}
],
"value": "Stack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers.\u00a0\n\n\n\nSentinel Keys Server does not check the length of the first field in\nthe input message. A local attacker may craft an input and send it to Sentinel\nKeys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling\nlocal privilege escalation.\n\n\n\n\n\nThis issue affects Sentinel Keys Server: versions\nlower than 1.3.8.0."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:47:48.568Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61\u0026sysparm_article=KB0031216"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade latest version."
}
],
"value": "Upgrade latest version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stack Buffer Overflow in Sentinel Keys Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-78402",
"datePublished": "2026-10-30T19:11:53.889Z",
"dateReserved": "2026-08-24T14:22:03.585Z",
"dateUpdated": "2026-10-30T20:00:42.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78403 (GCVE-0-2026-78403)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:12 – Updated: 2026-10-30 20:02
VLAI
EPSS
VEX
Title
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
Summary
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server. It may lead to remote code execution as NT
AUTHORITY\SYSTEM.
This issue affects Sentinel Keys Server:
versions lower than 1.3.8.0.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 19:59 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Sentinel Keys Server |
Affected:
0 , < 1.3.8.0
(custom)
cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T19:59:29.771309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:02:33.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel Keys Server",
"vendor": "Thalesgroup",
"versions": [
{
"lessThan": "1.3.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "1.3.8.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Hetelson (matthew.hetelson@revolutional.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\u003c/p\u003e\n\n\u003cp\u003eThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0.\u003c/p\u003e"
}
],
"value": "Stack-based buffer overflow and missing\nauthorization vulnerability in Thales Sentinel Keys Server on Windows allows\nOverflow Buffers. Sentinel Keys Server does not check the length of the first\nfield in the HTTP request. An attacker may craft an HTTP request and send it to\nSentinel Keys Server. It may lead to remote code execution as NT\nAUTHORITY\\SYSTEM.\n\n\n\n\n\nThis issue affects Sentinel Keys Server:\nversions lower than 1.3.8.0."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:48:32.603Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61\u0026sysparm_article=KB0031216"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to latest version."
}
],
"value": "Upgrade to latest version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unauthenticated Stack Buffer Overflow in Sentinel Keys Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-78403",
"datePublished": "2026-10-30T19:12:56.080Z",
"dateReserved": "2026-08-24T14:22:05.425Z",
"dateUpdated": "2026-10-30T20:02:33.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78402 (GCVE-0-2026-78402)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:11 – Updated: 2026-10-30 20:00
VLAI
EPSS
VEX
Title
Stack Buffer Overflow in Sentinel Keys Server
Summary
Stack-based buffer overflow and out-of-bounds
write vulnerability in Thales Sentinel Keys Server on Windows allows Overflow
Buffers.
Sentinel Keys Server does not check the length of the first field in
the input message. A local attacker may craft an input and send it to Sentinel
Keys Server. It may lead to code execution as NT AUTHORITY\SYSTEM enabling
local privilege escalation.
This issue affects Sentinel Keys Server: versions
lower than 1.3.8.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 20:00 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://supportportal.thalesgroup.com/csm?id=kb_a… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Thalesgroup | Sentinel Keys Server |
Affected:
0 , < 1.3.8.0
(custom)
cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78402",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T20:00:33.506955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T20:00:42.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Sentinel Keys Server",
"vendor": "Thalesgroup",
"versions": [
{
"lessThan": "1.3.8.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "1.3.8.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matt Hetelson (matthew.hetelson@revolutional.com)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eStack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers.\u0026nbsp;\u003c/p\u003e\u003cp\u003eSentinel Keys Server does not check the length of the first field in\nthe input message. A local attacker may craft an input and send it to Sentinel\nKeys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling\nlocal privilege escalation.\u003c/p\u003e\u003cp\u003e\n\nThis issue affects Sentinel Keys Server: versions\nlower than 1.3.8.0.\u003c/p\u003e"
}
],
"value": "Stack-based buffer overflow and out-of-bounds\nwrite vulnerability in Thales Sentinel Keys Server on Windows allows Overflow\nBuffers.\u00a0\n\n\n\nSentinel Keys Server does not check the length of the first field in\nthe input message. A local attacker may craft an input and send it to Sentinel\nKeys Server. It may lead to code execution as NT AUTHORITY\\SYSTEM enabling\nlocal privilege escalation.\n\n\n\n\n\nThis issue affects Sentinel Keys Server: versions\nlower than 1.3.8.0."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:47:48.568Z",
"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"shortName": "THA-PSIRT"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://supportportal.thalesgroup.com/csm?id=kb_article_view\u0026sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61\u0026sysparm_article=KB0031216"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade latest version."
}
],
"value": "Upgrade latest version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stack Buffer Overflow in Sentinel Keys Server",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395",
"assignerShortName": "THA-PSIRT",
"cveId": "CVE-2026-78402",
"datePublished": "2026-10-30T19:11:53.889Z",
"dateReserved": "2026-08-24T14:22:03.585Z",
"dateUpdated": "2026-10-30T20:00:42.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}