VulnSocial

CVE-2026-22582Disclosure(salesforce / marketing_cloud_engagement)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

salesforce CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-88

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • marketing_cloud_engagement

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
salesforce
Products
marketing_cloud_engagement

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-05: 1PoC Mentioned / Linked · 2026-05-05: 1Technical Details · 2026-05-05: 105-05
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Assetnote@assetnote
    Disclosure

    Our team discovered a vulnerability in Salesforce Marketing Cloud that allowed us to leak PII of subscribers and emails sent through SFMC, without any auth. Assigned CVE-2026-22585, CVE-2026-22586, CVE-2026-22582, CVE-2026-22583, CVE-2026-2298. Read our writeup here: https://slcyber.io/research-center/ghosts-of-encryption-past-salesforce-exacttarget/

    Post summary

    A team reports an authentication bypass in Salesforce Marketing Cloud that leaks subscriber PII and emails, assigns several CVEs, and links to a writeup but provides no exploit code or active exploitation evidence.

    025166387.0K
    10.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsalesforcemarketing_cloud_engagement---

Explore more

Back to dashboardsalesforce CVEsmarketing_cloud_engagement vulnerabilities