PT-2026-4540 · Salesforce · Salesforce Marketing Cloud Engagement

[e-mail] · Published 2026-01-24 · Updated 2026-05-05 · CVE-2026-22582

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salesforce Marketing Cloud Engagement versions prior to January 21st, 2026

Description Improper Neutralization of Argument Delimiters in a Command, also known as Argument Injection, in the MicrositeUrl module allows Web Services Protocol Manipulation. Argument Injection occurs when an application fails to properly sanitize user-supplied input used as a command-line argument, allowing an attacker to inject additional arguments to alter the command's behavior.

Recommendations Update Salesforce Marketing Cloud Engagement to a version released on or after January 21st, 2026. As a temporary workaround, restrict the use of the MicrositeUrl module to minimize the risk of exploitation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-22582

Affected Products

Salesforce Marketing Cloud Engagement

References · 5

• https://help.salesforce.com/s/articleView?id=005299346&type=1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22582 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22582 · Vendor Advisory
• https://twitter.com/assetnote/status/2051609063814037601 · Twitter Post
• https://t.me/CVEtracker/42893 · Telegram Post