CVE-2026-18397: Thales Sconnect

Critical severity, CVSS 9.4. EPSS: 0.3% chance of exploitation in the next 30 days.

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

Affected products

• Thales Sconnect: before 2.16.1.0 (fixed in 2.16.1.0)

Published 2026-10-01. Last modified 2026-10-02.