Thales SConnect EUVD-2026-91132

Exploitation requires that the Thales SConnect native host component is installed on the victim's endpoint and that the victim visits or is redirected to an attacker-controlled web page (the UI:P/passive interaction in the CVSS vector) - the page then abuses the native host's unrestricted messaging interface. No authentication is required (PR:N). The principal limiting factors are: the target must have SConnect deployed (a specific smart-card authentication component, not default on general systems), and a user must load the malicious page; there is no requirement for attacker-side privileges or special network position beyond standard internet reachability.

This is a genuine high-priority vulnerability, not an inflated high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H with subsequent-system impact SC:H/SI:H/SA:H) describes unauthenticated, low-complexity, network-reachable remote code execution where the only gating factor is passive user interaction (the victim visiting an attacker-controlled web page). CWE-347 (improper verification of a cryptographic signature) combined with the 'Jwt Attack' tag and the description's reference to cryptographic weaknesses plus memory-management issues indicates a signature-bypass chain that defeats the native host's trust checks. Signals are internally consistent: the network vector and no-privilege requirement match the described browser-to-native-host messaging interface. Key gaps: no EPSS score, no CISA KEV listing, and no POC were provided, so exploitation-probability and in-the-wild signals are absent - risk here is inferred from the vector and bug class rather than observed exploitation. There is no SSVC decision data in the input. Because exploitation needs a user to load a malicious page (UI:P/UI:R), this is better characterized as drive-by/targeted rather than wormable mass exploitation, which tempers but does not negate the severity.

An attacker lures a victim who has the Thales SConnect native host installed to a malicious or compromised web page; the page abuses the unrestricted messaging interface to send crafted input that exploits the cryptographic signature-verification weakness (JWT-style) and the memory-management flaw, yielding code execution on the victim's machine with no authentication. No public exploit code was identified at time of analysis, so this remains a plausible but not-yet-demonstrated chain.