CVE-2026-22586

The vulnerability results from the use of a static cryptographic key hardcoded into the code in several platform modules: CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, and View As Webpage. An attacker, knowing or reproducing this key, can manipulate communication based on Web Services Protocol Manipulation. Since the key is shared across all installations, its compromise affects potentially all users using vulnerable modules. The attack requires no authentication or user interaction.

An attacker can gain full control over the confidentiality, integrity, and availability of data processed by vulnerable modules, which may lead to unauthorized reading, modification, or deletion of marketing and customer data.

Salesforce released a patch dated January 21, 2026. Ensure that the Marketing Cloud Engagement environment has been updated to a version after this date. Detailed information is available in the Salesforce technical support article referenced (ID: 005299346). It is also recommended to verify access logs to vulnerable modules to detect any potential unauthorized access attempts.

Salesforce Marketing Cloud Engagement in all versions released before January 21, 2026, in the modules: CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage.