EUVD-2026-114364
GHSA-fxcq-q77c-fh3w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Sentinel Keys Server HTTP port
-
ExploitCraft oversized first HTTP field
-
ExecutionTrigger stack buffer overflow
-
ImpactExecute code as NT AUTHORITY\SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against Sentinel Keys Server (versions lower than 1.3.8.0) on Windows: the server does not check the length of the first field in an HTTP request, so any attacker who can reach its HTTP listener can trigger the overflow. The only real limiting factor is network reachability of the Sentinel Keys Server service; there is no authentication, user-interaction, or special-configuration requirement stated. Exploitation requires that the vulnerable version be deployed and its HTTP service exposed to the attacker. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) describes remote, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability impact, and the description confirms the mechanism: a missing length check on the first field of an HTTP request produces a stack-based buffer overflow (CWE-121) leading to code execution as NT AUTHORITY\SYSTEM. The vuln.today Decision label is act_now, which aligns with the network-reachable, no-auth, SYSTEM-level outcome. Counter-signals exist: there is no CISA KEV listing, no public exploit reference, and no EPSS score provided, so there is currently no evidence of active or at-scale exploitation - the urgency rests on the intrinsic severity and the act_now decision, not on observed attacks. The missing authorization flaw reinforces the PR:N rating. Net: treat as an act_now patching priority given SYSTEM-level unauthenticated RCE, while recognizing that exploitation-in-the-wild is unconfirmed and EPSS is absent from the input. |
| Exploit ScenarioDerived | An attacker with network access to a Sentinel Keys Server instance sends a single crafted HTTP request whose first field exceeds the unchecked length, overflowing a stack buffer and executing attacker-supplied code as NT AUTHORITY\SYSTEM. Because no authentication is required (PR:N) and complexity is low (AC:L), any party able to reach the service port can attempt this. No public exploit code or PoC reference is present in the supplied data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Remote code execution in Thales Sentinel Keys Server on Windows (versions lower than 1.3.8.0) lets unauthenticated network attackers compromise the service by sending a crafted HTTP request whose first field is overlong, overflowing a stack buffer and leading to code execution as NT AUTHORITY\SYSTEM. The same request path also lacks an authorization check, so no credentials or user interaction are required - the practical gating factor is whether the Sentinel Keys Server HTTP listener is reachable from the attacker. It is scored 9.3 under CVSS v4.0 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) and is triaged act_now; no CISA KEV entry is reported and no public exploit code is identified in the provided sources.
RemediationAI
Upgrade Thales Sentinel Keys Server to 1.3.8.0 or later - the advisory lists affected versions as lower than 1.3.8.0, making 1.3.8.0 the first fixed release referenced (vendor advisory: https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50fc9f3b3b005f10bba8b41864e45a61&sysparm_article=KB0031216). No workaround or compensating control is documented in the supplied sources, and because the overflow sits directly in HTTP request parsing there is no feature setting described that removes the exposure short of the fix. The independent assessment notes that exploitability is gated only by network reachability of the Sentinel Keys Server HTTP listener, so restricting which hosts and networks can reach that listener limits exposure while the 1.3.8.0 upgrade is staged, at the cost of blocking legitimate licensing clients that rely on remote access to the service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-121 stack-based buffer overflow in the HTTP request handling of Thales Sentinel Keys Server for Windows. Per the vendor advisory, the server does not validate the length of the first field in an incoming HTTP request, so attacker-supplied data is written past a fixed-size stack buffer; the sources state this can lead to remote code execution in the context of NT AUTHORITY\SYSTEM, the highly privileged account the service runs under. The same advisory attributes a missing authorization check to the affected request handling, meaning the vulnerable path is reachable without establishing an authorized session. The CPE entry cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:*:*:*:*:*:* covers all versions below the fixed release, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) is consistent with a network-reachable, unauthenticated trigger and no additional attack prerequisites. The sources describe the trigger as the unchecked length of the first HTTP field; precisely how the overwrite is converted into control-flow hijack, and which platform mitigations apply, is not described in the available sources.
Know when Sentinel Keys Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N) due to missing authorization and unchecked length; SYSTEM-level RCE gives C:H/I:H/A:H with scope unchanged (SC/SI/SA:N in the 4.0 source).
Primary rating from Vendor (THA-PSIRT).
CVSS VectorVendor: THA-PSIRT
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM.
This issue affects Sentinel Keys Server: versions lower than 1.3.8.0.
Articles & Coverage 2
Executive ViewAI
A critical unauthenticated remote code execution vulnerability in Thales Sentinel Keys Server (versions below 1.3.8.0) on Windows allows network attackers to compromise the service without credentials. This puts any organization with an internet-facing or broadly reachable instance at risk of full system compromise, potentially leading to data breaches, service disruption, and regulatory exposure. Leadership should prioritize immediate mitigation because no patch is currently available.
Restrict network access to the Sentinel Keys Server HTTP listener to trusted hosts only; deploy WAF/IPS rules to block malformed requests; monitor for anomalous activity; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB