CVE-2026-18397
This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.
- Published Oct 1, 2026
- CVSS 9.4 critical
- 0.3% chance of exploitation in the next 30 days (EPSS)
Affected software
In the news
- SWIFT Banking & Government Middleware Enables RCE Dark Reading ·