Marketing Cloud Engagement vulnerabilities

5 known vulnerabilities in Marketing Cloud Engagement from Salesforce. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  Marketing Cloud Engagement: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-2298Mar 23, 2026Salesforce

  Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.

• 9.8 Critical severity

  Marketing Cloud Engagement: Use of Hard-coded Cryptographic Key

  CVE-2026-22586Jan 24, 2026Salesforce

  Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Mark

• 9.8 Critical severity

  Marketing Cloud Engagement: Use of a Broken or Risky Cryptographic Algorithm

  CVE-2026-22585Jan 24, 2026Salesforce

  Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. Thi

• 9.8 Critical severity

  Marketing Cloud Engagement: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-22583Jan 24, 2026Salesforce

  Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before Ja

• 9.8 Critical severity

  Marketing Cloud Engagement: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-22582Jan 24, 2026Salesforce

  Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before Jan