PT-2026-4542 · Salesforce · Salesforce Marketing Cloud Engagement

[e-mail] · Published 2026-01-24 · Updated 2026-05-05 · CVE-2026-22585

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salesforce Marketing Cloud Engagement versions prior to January 21st, 2026

Description Use of a broken or risky cryptographic algorithm in the CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, and View As Webpage modules allows for Web Services Protocol Manipulation. Technical details indicate the presence of a padding oracle—a side-channel attack that reveals plaintext by analyzing error responses from a decryption oracle—utilizing a static AES key shared across every tenant.

Recommendations Update Salesforce Marketing Cloud Engagement to a version released on or after January 21st, 2026.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2026-22585

Affected Products

Salesforce Marketing Cloud Engagement

References · 9

• https://osv.dev/vulnerability/CVE-2026-22585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22585 · Security Note
• https://help.salesforce.com/s/articleView?id=005299346&type=1 · Vendor Advisory
• https://twitter.com/assetnote/status/2051609063814037601 · Twitter Post
• https://twitter.com/CVEnew/status/2014995816206016572 · Twitter Post
• https://t.me/CVEtracker/42895 · Telegram Post
• https://twitter.com/ITSecurityguard/status/2051619146975076440 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014901500539977830 · Twitter Post
• https://twitter.com/TheHackerWire/status/2015878223842967853 · Twitter Post