CVE-2026-18397

Received Received - Intake

Unauthenticated RCE via SConnect Native Host

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Thales Group

Description

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-01

Generated

2026-10-02

AI Q&A

2026-10-02

EPSS Evaluated

N/A

NVD

CVE-2026-18397

Affected Vendors & Products

Vendor	Product	Version / Range
thales	connect	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthenticated remote code execution on a victim's machine by exploiting cryptographic weaknesses and memory management issues in the SConnect native host component. It uses an unrestricted messaging interface between an attacker-controlled web page and the native host to bypass security checks and inject malicious input.

Detection Guidance

Detection of this vulnerability requires monitoring for unauthorized remote code execution attempts via the SConnect native host component. Check for unusual network traffic patterns or processes spawned by web pages interacting with the native host. Inspect logs for suspicious input bypassing security checks in the messaging interface.

Impact Analysis

An attacker could remotely execute arbitrary code on your system without authentication, potentially leading to full system compromise, data theft, or installation of malware. This could affect confidentiality, integrity, and availability of your data and systems.

Compliance Impact

This vulnerability allows unauthenticated remote code execution, which could lead to unauthorized access to sensitive data. Such access may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Disable or restrict access to the SConnect native host component to prevent unauthenticated remote code execution. Update to the latest patched version if available. Monitor network traffic for suspicious activity targeting the SConnect interface.

Hi! I’m here to help you understand CVE-2026-18397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70