SWIFT Banking & Government Middleware Enables RCE

Researchers disclosed a critical RCE vulnerability (CVE-2026-18397, CVSS 9.4) in Thales' SConnect middleware used by governments and the SWIFT banking ecosystem. A flawed, home-grown RSA signature check in the browser-extension/native host allows malicious webpages to bypass authentication via oversized signatures and heap-sprays, letting an attacker load a malicious DLL and gain system-level control in seconds; Bay Area Labs reproduced the exploit with ~18% success using AI-assisted tooling. Thales has released patches and removed/updated the app from some stores, but SConnect is still in use (and only recently EoL), leaving potentially large financial and government attack surfaces until fully migrated to replacements like Web Connect.