PT-2026-4541 · Salesforce · Salesforce Marketing Cloud Engagement

[e-mail] · Published 2026-01-24 · Updated 2026-05-05 · CVE-2026-22583

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salesforce Marketing Cloud Engagement versions prior to January 21st, 2026

Description Improper Neutralization of Argument Delimiters in a Command (Argument Injection) in the CloudPagesUrl module allows Web Services Protocol Manipulation. Argument Injection occurs when an application fails to properly sanitize user-supplied input used as a command-line argument, allowing an attacker to inject additional arguments to alter the command's behavior.

Recommendations Update to the version released on or after January 21st, 2026. Restrict the use of the CloudPagesUrl module as a temporary mitigation measure.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-22583

Affected Products

Salesforce Marketing Cloud Engagement

References · 7

• https://help.salesforce.com/s/articleView?id=005299346&type=1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22583 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22583 · Vendor Advisory
• https://twitter.com/assetnote/status/2051609063814037601 · Twitter Post
• https://twitter.com/TheHackerWire/status/2015878175679774885 · Twitter Post
• https://t.me/CVEtracker/42894 · Telegram Post
• https://twitter.com/CVEnew/status/2014995813114761406 · Twitter Post