Thales SConnect: Unauthenticated remote code execution via native host
Summary
Thales SConnect, a connectivity component that enables messaging between web applications and a native host, contains a critical flaw in its cryptographic signature verification and memory handling. An attacker can craft a malicious web page that sends crafted input to the native host and runs code on the victim's computer. Exploitation requires the victim to visit the attacker-controlled page in a browser with the SConnect extension installed.
Affected
- Thales SConnect versions prior to 2.16.1.0 (likely threshold; to be confirmed against the Thales advisory)
- Some secondary sources describe the range as builds released before August 2026
- Default configuration: unaffected according to the CVE record
Fixed in
- Thales SConnect 2.16.1.0 or later (to be confirmed against the Thales advisory)
- Chrome Web Store and Apple App Store builds were updated in August 2026; the Microsoft Edge version was removed in September 2026
Workaround
- No vendor-tested workaround is known.
- General interim measure: restrict access to the native host component and limit exposure to untrusted web content.
- Migration to SWIFT Web Connect is reported as the replacement; SConnect is reported as end of life.
Exploitation
- No confirmed exploitation in the wild at last check.
- Not listed as a known exploited vulnerability in CISA KEV according to one secondary source (not checked directly).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof-of-concept status is reported by researchers; PoC code was not verified.
Our recommendation
- Create an inventory of browsers and extensions to check whether SConnect is installed anywhere.
- If installed, confirm the version and update to 2.16.1.0 or later, or remove it.
- Plan the migration to the vendor-recommended replacement, as SConnect is reported as end of life.
- Review proxy logs for native host connections to unexpected domains and EDR for DLL loads from user temp or application data paths.
- Verify version and fix data against the Thales advisory and the NVD record, which was pending at last check.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Thales Product Security Incident Response www.thalesgroup.com
- Rescana: CVE-2026-18397 critical RCE in Thales SConnect www.rescana.com
- Dark Reading: SWIFT banking and government middleware RCE www.darkreading.com
- OffSeq Radar: CVE-2026-18397 radar.offseq.com
- Tech Jacks: SConnect RCE and hardware MFA bypass techjacksolutions.com
- Aviatrix: SWIFT banking middleware RCE CVE-2026-18397 aviatrix.ai
- VulDB entry 412835 vuldb.com
- Pulse Adyog: researchers show attack on SConnect pulse.adyog.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:15.
Original description (NVD)
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.