CVE-2026-3457 is a stored cross-site scripting (XSS) vulnerability classified under CWE-79 affecting Thales Sentinel LDK Runtime on Windows platforms prior to version 10.22. The issue stems from improper input neutralization during web page generation, which can allow an attacker to inject malicious scripts that persist and execute in the context of the application. The vulnerability has a CVSS 4.0 base score of 7.0, reflecting high severity with local attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. There is no information on an official patch or vendor advisory, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with local access to inject and execute malicious scripts within the Sentinel LDK Runtime environment. This can lead to unauthorized actions or data exposure within the context of the affected application. The CVSS score indicates a high impact on confidentiality and integrity, but the attack requires local access and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit local access to the Sentinel LDK Runtime environment and monitor for any unusual activity related to web page generation within the application. Avoid running untrusted code or input through the affected versions. Stay alert for updates from Thales regarding patches or workarounds.