---
title: Critical Flaw Let Any Website Run Code on Machines Used for SWIFT
description: Critical SConnect vulnerability in SWIFT login software allows remote code execution; users urged to switch to Web Connect immediately.
canonical_url: https://codekeeper.co/ticker/sconnect-vulnerability-swift-users-switch
---

[Software security](https://codekeeper.co/ticker/tag/software-security) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Critical Flaw Let Any Website Run Code on Machines Used for SWIFT

Critical SConnect vulnerability in SWIFT login software allows remote code execution; users urged to switch to Web Connect immediately.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Researchers at Bay Area Labs have uncovered a critical vulnerability (CVE-2026-18397, scored 9.4 by Thales on the CVSS 4.0 scale) in SConnect, a browser-based authentication tool with more than a million Chrome installs, used to access SWIFT banking networks and major government systems in Qatar and Sweden. The flaw lets attackers execute remote code on victims' machines via a malicious webpage, or any iframe loaded onto one — no interaction required beyond a visit, and 6–10 seconds in the researchers' testing. The bug stems from a homegrown cryptographic check. SConnect verifies a site's RSA signature inside a block of memory it never clears first, so whatever was there before stays put. Feed it an oversized signature and the calculation fails without writing anything — but the check reads that block anyway. That means an attacker who sprays the right bytes into memory passes as a Thales-approved site, and an approved site can tell SConnect to load a plugin. Pulling that off isn't easy: AI-assisted exploitation made it work roughly 18% of the time. But failed attempts raise nothing the user can see, so an attacker just keeps firing until one lands. Thales patched the Chrome and Apple versions on August 7, then pulled SConnect from Edge on September 13 — 89 000 users still had it, and the researchers can't confirm those copies were removed — and published the CVE on October 1. SWIFT replaced SConnect with Web Connect in September 2025 and retired SConnect in September this year. Even so, the researchers expect SConnect is still the fallback wherever Web Connect isn't configured, which is why many SWIFT users may still be running it. Update to host 2.16.1.0 and extension 2.16.1.1, then switch to Web Connect. Source: [Dark Reading](https://www.darkreading.com/cybersecurity-operations/swift-banking-govt-middleware-rce)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fsconnect-vulnerability-swift-users-switch%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities OpenAI Agent Swarm Flooded RubyGems and Ran Code on RubyDoc's Servers Sep 14, 2026](https://codekeeper.co/ticker/aigents-infiltrate-rubygems-exploit-api-flaws)

[Microsoft Exchange SSRF Vulnerability Exposed — PoC Exploit Now Public Aug 12, 2026](https://codekeeper.co/ticker/ssrf-vulnerability-found-in-microsoft-exchange)

[Coordinated Cyberattack Hits 30+ Minnesota Water Utilities Aug 11, 2026](https://codekeeper.co/ticker/minnesota-water-systems-cyberattack-july-2023)

[Data breaches Revolut Data Breach Exposed Passports to a Fake Government Email Sep 14, 2026](https://codekeeper.co/ticker/revolut-data-breach-exposes-sensitive-customer-info)