CVE-2026-18397

CVE Enrichment

CVSS: 9.4 CRITICAL
EPSS: 0.34%
EPSS Percentile: 25.10%
CISA KEV: Not listed

Description

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: psirt@thalesgroup.com
Published: 02-Oct-2026 05:17
Last Modified: 03-Oct-2026 03:17
EPSS Date: 2026-10-10
CWE: CWE-130, CWE-252, CWE-347, CWE-457

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:P /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

psirt@thalesgroup.com

Last enrichment sync: 11-Oct-2026 11:48
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

DataDirect), CVE-2025-64393, CVE-2026-58069 (Veeam Backup & Replication), CVE-2026-32740 (Next.js), CVE-2026-18397 (Thales SConnect), CVE-2026-84388 (Fortinet FortiPAM Chrome extension), CVE-2026-76464, Weekly Cybersecurity Recap Highlights Exploited Atlassian Flaw and Other Threats
Store in August and removed the app entirely from Microsoft Edge in September. It published a CVE, CVE-2026-18397, on Oct. 1. The company assigned it a "critical" 9.4 out of 10 in the Common Vulnerability Scoring Critical SConnect Flaw Enables Drive-By Remote Code Execution

CVE (52)

People (1)

Vendors (2)

Products (13)

Tools (2)

Industries (3)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.