by Kastro
Paper/Archive/CVE-2026-18397

CVE-2026-18397

Thales SConnect — SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

EPSS 0.3%CVSS 9.4
critical.is priorityof 100
34
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 27.9.279 × 205.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

Affected

ProductAffectedFixed inSource
SConnect< 2.16.1.02.16.1.0CNA

Scores by source

THA-PSIRT (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorythalesgroup.com/en/product-security-incident-response