Salesforce vulnerabilities

We track 25 vulnerabilities in Salesforce products across 7 products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on March 23, 2026.

25vulnerabilities

8critical

17high

0exploited

8.5average CVSS score

Latest Salesforce vulnerabilities

9.4 Critical severity
Marketing Cloud Engagement: Improper Neutralization of Argument Delimiters in a Command
CVE-2026-2298Mar 23, 2026Salesforce
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.
9.8 Critical severity
Marketing Cloud Engagement: Use of Hard-coded Cryptographic Key
CVE-2026-22586Jan 24, 2026Salesforce
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Mark
9.8 Critical severity
Marketing Cloud Engagement: Use of a Broken or Risky Cryptographic Algorithm
CVE-2026-22585Jan 24, 2026Salesforce
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. Thi
9.8 Critical severity
Marketing Cloud Engagement: Improper Neutralization of Argument Delimiters in a Command
CVE-2026-22583Jan 24, 2026Salesforce
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before Ja
9.8 Critical severity
Marketing Cloud Engagement: Improper Neutralization of Argument Delimiters in a Command
CVE-2026-22582Jan 24, 2026Salesforce
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before Jan
9.8 Critical severity
Uni2TS: Improper Control of Generation of Code
CVE-2026-22584Jan 9, 2026Salesforce
Improper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage Executable Code in Non-Executable Files.This issue affects Uni2TS: through 1.2.0.
8.8 High severity
Salesforce CLI: Uncontrolled Search Path Element
CVE-2025-9844Sep 23, 2025Salesforce
Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects Salesforce CLI: before 2.106.6.
8.5 High severity
Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc…
CVE-2025-52451Aug 22, 2025Salesforce
Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3
7.3 High severity
Tableau Server: Unrestricted Upload of File with Dangerous Type
CVE-2025-26498Aug 22, 2025Salesforce
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (establish-connection-no-undo modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023
7.3 High severity
Tableau Server: Unrestricted Upload of File with Dangerous Type
CVE-2025-26497Aug 22, 2025Salesforce
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Editor modules) allows Absolute Path Traversal.This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
9.3 Critical severity
Tableau Server, Tableau Desktop: Access of Resource Using Incompatible Type
CVE-2025-26496Aug 22, 2025Salesforce
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, b
8.2 High severity
Tableau Server: Server-Side Request Forgery
CVE-2025-52454Jul 25, 2025Salesforce
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
8.2 High severity
Tableau Server: Server-Side Request Forgery
CVE-2025-52453Jul 25, 2025Salesforce
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
8.5 High severity
Tableau Server: Improper Limitation of a Pathname to a Restricted Directory
CVE-2025-52452Jul 25, 2025Salesforce
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2
8.5 High severity
Tableau Server: Unrestricted Upload of File with Dangerous Type
CVE-2025-52449Jul 25, 2025Salesforce
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3
8.1 High severity
Tableau Server: Authorization Bypass Through User-Controlled Key
CVE-2025-52448Jul 25, 2025Salesforce
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server:
8.1 High severity
Tableau Server: Authorization Bypass Through User-Controlled Key
CVE-2025-52447Jul 25, 2025Salesforce
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Se
8.0 High severity
Tableau Server: Authorization Bypass Through User-Controlled Key
CVE-2025-52446Jul 25, 2025Salesforce
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.
7.5 High severity
OmniStudio: Improper Preservation of Permissions
CVE-2025-43701Jun 10, 2025Salesforce
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.
7.5 High severity
OmniStudio: Improper Preservation of Permissions
CVE-2025-43700Jun 10, 2025Salesforce
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025.
9.1 Critical severity
OmniStudio: Improper Preservation of Permissions
CVE-2025-43698Jun 10, 2025Salesforce
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects. This impacts OmniStudio: before Spring 2025
7.5 High severity
OmniStudio: Improper Preservation of Permissions
CVE-2025-43697Jun 10, 2025Salesforce
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025
7.5 High severity
Tableau Server: Cleartext Storage of Sensitive Information
CVE-2025-26495Feb 11, 2025Salesforce
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14,
7.7 High severity
Tableau Server: Server-Side Request Forgery
CVE-2025-26494Feb 11, 2025Salesforce
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5.
8.1 High severity
docusign_api_package_for_salesforce: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-39344Aug 21, 2024Salesforce
An issue was discovered in the Docusign API package 8.142.14 for Salesforce. The Apttus_DocuApi__DocusignAuthentication__mdt object is installed via the marketplace from this package and stores some configuration information in a manner that could be compromis