Visa's EMV contactless kernel (Kernel 3) is vulnerable to the Zombie Card attack, which allows expired cards to be revived for transactions by rewriting the expiration date. Visa has not yet published a public advisory or mitigation as of August 20, 2026.