A serious vulnerability in SConnect could be exploited by heap-spraying crafted patterns to bypass checks, allowing unauthenticated or partially authenticated access to trusted sites.

Thales Group patched SConnect in August across Apple App Store and Chrome Web Store and removed it from Microsoft Edge in September; a CVE-2026-18397 was issued on October 1, 2026, with a critical CVSS score of 9.4/10, urging users to update immediately.

SWIFT is moving away from SConnect toward Web Connect, and SConnect is technically End of Life as of the prior month, though many users still rely on it as a fallback if Web Connect isn’t configured.

Thales has not commented publicly on the issue, while the industry assesses the potential blast radius and mitigation steps for affected systems.

A critical vulnerability was found in SConnect, a hardware-based MFA authentication middleware used by major government systems and the SWIFT banking network.

Researchers demonstrated an end-to-end exploit in six to ten seconds, and noted that AI-assisted tooling could broaden access to such exploits, potentially shifting control from nation-states to more autonomous actors.

Experts warn of broader breach scenarios, such as relaying challenges to sign documents with a victim’s identity card, which could compromise session integrity and enable fraud or unauthorized transfers, though testing is limited by access to 3SKey tokens.

The vulnerability enables drive-by remote code execution against users, potentially loading malicious DLLs and gaining control within seconds.

SConnect works by pairing a lightweight browser extension with a native host to coordinate authentication between hardware tokens and websites, including access to SWIFT and government portals.

Bay Area Labs researchers found the SConnect browser extension can accept messages from any webpage or iframe; a malformed, oversized RSA signature could read a stale memory buffer, enabling forgery of signature results and successful exploitation.