PT-2026-4543 · Salesforce · Salesforce Marketing Cloud Engagement

Hackerone: H_A_0_K_E_R · Published 2026-01-24 · Updated 2026-05-05 · CVE-2026-22586

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Salesforce Marketing Cloud Engagement versions prior to January 21st, 2026

Description A hard-coded cryptographic key in the CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, and View As Webpage modules allows for Web Services Protocol Manipulation.

Recommendations Update to the version released on or after January 21st, 2026.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2026-22586

Affected Products

Salesforce Marketing Cloud Engagement

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-22586 · Security Note
• https://help.salesforce.com/s/articleView?id=005299346&type=1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22586 · Vendor Advisory
• https://twitter.com/assetnote/status/2051609063814037601 · Twitter Post
• https://t.me/CVEtracker/42896 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014883581793870207 · Twitter Post
• https://twitter.com/TheHackerWire/status/2015878325848465501 · Twitter Post
• https://twitter.com/FergusonVates/status/2015809269791084754 · Twitter Post
• https://twitter.com/hot_labor/status/2015845538227425783 · Twitter Post
• https://twitter.com/TheHackerWire/status/2015892620992827606 · Twitter Post
• https://twitter.com/CVEnew/status/2014995815190962627 · Twitter Post
• https://twitter.com/TheHackerWire/status/2015878554026983532 · Twitter Post