TI-2026-01943 Aliases CVE-2026-2298 GHSA-25fg-84xv-353x

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…

MEDIUM 47CWE-88Published 2026-03-23 · Updated 2026-04-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-88.

Summary

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00429 37th percentileScored 2026-11-07

Fix Fixed Marketing Cloud Engagement (Salesforce): January 30th, 2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Salesforce	Marketing Cloud Engagement	before January 30th, 2026	January 30th, 2026	Patch available	CNA

Marketing Cloud Engagement VendorSalesforce Affected before January 30th, 2026 Fixed in January 30th, 2026 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:salesforce:marketing_cloud_engagement::::::::	—	—	Salesforce

cpe:2.3:a:salesforce:marketing_cloud_engagement:*:*:*:*:*:*:*:* Versions — — ·Salesforce

Remediation

Fix · CNA Marketing Cloud Engagement (Salesforce) Fixed in January 30th, 2026

Timeline

2026-10-02 Threatist record created from CVE-2026-2298
2026-10-03 Alias added: GHSA-25fg-84xv-353x

References

Other 1

https://help.salesforce.com/s/articleView?id=005299346&type=1

TI-2023-11360 Prototype pollution in tough-cookie CVSS 3.1CRITICAL 9.8
TI-2026-18147 Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement… CVSS 3.1CRITICAL 9.8
TI-2026-18144 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')… CVSS 3.1CRITICAL 9.8
TI-2026-18143 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')… CVSS 3.1CRITICAL 9.8
TI-2016-09132 forcedotcom SalesforceMobileSDK-Windows QuerySpec.cs ComputeCountSql sql injection CVSS 3.1CRITICAL 9.8
TI-2026-18146 Broken or risky cryptographic algorithm in Salesforce Marketing Cloud Engagement CVSS 3.1CRITICAL 9.8

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences