PT-2025-34490 · Salesforce · Tableau Desktop+1

Published 2025-08-22 · Updated 2025-11-04 · CVE-2025-26496

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tableau Server and Tableau Desktop versions prior to 2025.1.3 Tableau Server and Tableau Desktop versions prior to 2024.2.12 Tableau Server and Tableau Desktop versions prior to 2023.3.19

Description: A 'Type Confusion' vulnerability exists in Salesforce Tableau Server and Tableau Desktop on Windows and Linux within the File Upload modules. This vulnerability allows for Local Code Inclusion, potentially enabling attackers to upload malicious files and execute arbitrary code. Approximately 169,926 systems are potentially exposed, as indicated by ZoomEye search results.

Recommendations: Tableau Server and Tableau Desktop versions prior to 2025.1.3: Upgrade to version 2025.1.3 or later. Tableau Server and Tableau Desktop versions prior to 2024.2.12: Upgrade to version 2024.2.12 or later. Tableau Server and Tableau Desktop versions prior to 2023.3.19: Upgrade to version 2023.3.19 or later.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2025-26496

Affected Products

Tableau Desktop

Tableau Server

References · 21

• https://cve.org/CVERecord?id=CVE-2022-1364 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26496 · Vendor Advisory
• https://help.salesforce.com/s/articleView?id=005132575&type=1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26496 · Security Note
• https://twitter.com/fridaysecurity/status/1959815604988420251 · Twitter Post
• https://t.me/CVEtracker/30734 · Telegram Post
• https://twitter.com/Netlas_io/status/1959849972620284220 · Twitter Post
• https://twitter.com/zoomeye_team/status/1959930787215650974 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1n0hqrs/top_10_trending_cves_26082025 · Reddit Post
• https://twitter.com/CCBalert/status/1959974309021049217 · Twitter Post
• https://t.me/pentestingnews/66848 · Telegram Post
• https://twitter.com/DarkWebInformer/status/1960755720367772008 · Twitter Post
• https://twitter.com/zoomeye_team/status/1959929520506446175 · Twitter Post
• https://t.me/netlas/468 · Telegram Post
• https://t.me/cveNotify/141593 · Telegram Post