Signals
Back to database
Schedule52Critical9.4VulnerabilityCVE-2026-18397No patch link observed

CVE-2026-18397 — This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesse…

Published Oct 1, 2026, 10:17 PM UTCIngested 7d agoSource NVD(cve-db)CVE-2026-18397

Description

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

CVSS v4.0 base metrics

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
9.4

Critical severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Network

Attack Vector

AC

Low

Attack Complexity

AT

None

Attack Requirements

PR

None

Privileges Required

UI

Passive

User Interaction

VC

High

Confidentiality (Vulnerable System)

VI

High

Integrity (Vulnerable System)

VA

High

Availability (Vulnerable System)

SC

High

Confidentiality (Subsequent System)

SI

High

Integrity (Subsequent System)

SA

High

Availability (Subsequent System)

References

Related threats

same CWE or vendor
High

CVE-2026-107724 — fast-jwt provides fast JSON Web Token (JWT) implementation.

CVE-2026-107724 · 56m ago

Critical

CVE-2026-107722 — fast-jwt provides fast JSON Web Token (JWT) implementation.

CVE-2026-107722 · 56m ago

High

CVE-2026-107720 — fast-jwt provides fast JSON Web Token (JWT) implementation.

CVE-2026-107720 · 56m ago

Medium

CVE-2026-106436 — The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit.

CVE-2026-106436 · 3h ago

High

CVE-2026-14999 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a re…

CVE-2026-14999 · 8h ago

High

CVE-2026-14497 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a re…

CVE-2026-14497 · 8h ago