Thales SConnect RCE Exposes SWIFT Banking and Government Users

🕵️ RESEARCH & DEEP DIVES

• Thales SConnect Middleware Flaw Enables Drive-By RCE Against SWIFT, Government Users
  Researchers disclosed a critical drive-by RCE vulnerability in Thales' SConnect browser middleware used to access SWIFT banking and government systems.

  • Affects SConnect, a Thales browser extension with over 1 million Chrome users, used for authentication to SWIFT banking, Qatar's Tawtheeq national ID, the Swedish Tax Agency, and banking/insurance portals.
  • Tracked as CVE-2026-18397 with a critical CVSS 4.0 score of 9.4; the flaw stems from a hand-rolled RSA signature check vulnerable to heap-spray forgery via an oversized invalid signature.
  • Any webpage or iframe could send messages to the extension; attackers can load a malicious DLL through the native host for full RCE in 6-10 seconds, with failed attempts showing no visible error.
  • Bay Area Labs developed the exploit using AI agents with Ghidra and Frida, succeeding in heap-spray forgery about 18% of the time.
  • Thales patched SConnect on the Apple App Store and Chrome Web Store in August, removed it from Microsoft Edge in September, and published the CVE on Oct. 1; SConnect reached end of life in September 2025 as SWIFT migrates users to Web Connect.
  Sources 📄 Source: infosec.exchange · 📎 Coverage: darkreading.com · 👁 via Dark Reading

• U-Boot RLE8 splash image decoder flaw enables pre-auth Secure Boot bypass (CVE-2026-71972) CVE-2026-71972
  An out-of-bounds write in U-Boot's RLE8 BMP splash image decoder allows a crafted boot logo to corrupt memory and bypass Secure Boot.

  • Affects U-Boot through 2026.10-rc5, the BMP RLE8 decode path in drivers/video/video_bmp.c (video_display_rle8_bitmap()).
  • The decoder does not bound decoded runs against the framebuffer size, so a crafted RLE8-compressed BMP writes past the framebuffer into adjacent bootloader memory.
  • Boot logos are commonly loaded from unsigned, attacker-writable storage (SPI flash, MMC/eMMC, USB, SD card) and decoded before the next boot stage is authenticated, enabling a pre-authentication Secure Boot bypass.
  • Discovered and reported by Shahriyar Jalayeri and Mehrun P. Hunter of ByteRay; disclosed 2026-09-29, CVSS 6.0/5.9, CWE-787, not known exploited.
  • Fixed in commit 5201e83342d64c2f438ea35158575f28225e752e, currently in the u-boot/next branch and not yet in a tagged release.
  Sources 📄 Source: vulncheck.com · 📎 Coverage: pop.byteray.co.uk · 👁 via r/netsec

📋 ADVISORIES

• 📄 Source for GitLab urges immediate patching of critical AI Gateway RCE flaw CVE-2026-90970 — nvd.nist.gov

• 📄 Source for Critical RCE flaw in Thales SConnect browser middleware used for SWIFT, banking, and government authentication — reddit.com

• 📄 Source for Google Chrome 154.0.8037.97 update fixes 11 flaws including sandbox escapes and data leaks — chromereleases.googleblog.com

🔓 CVEs & KEV

• CVE-2026-12627 — Fortra Fortra's Core Privileged Access Manager (BoKS) — CVSS 9.8 — Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer ...

• CVE-2026-79896 — Fortra BoKS Manager — CVSS 7.5 — Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerabi...