Read the docs
TI-2026-18146 Aliases CVE-2026-22585GHSA-h763-98v5-2w53

Broken or risky cryptographic algorithm in Salesforce Marketing Cloud Engagement

Priority MEDIUM 49CWE-327Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-327.

Summary

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00425 37th percentileScored 2026-11-07
Fix Fixed Marketing Cloud Engagement (Salesforce): January 21, 2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SalesforceMarketing Cloud Engagementbefore January 21, 2026January 21, 2026Patch availableCNA
  • Marketing Cloud Engagement VendorSalesforce Affected before January 21, 2026 Fixed in January 21, 2026 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:salesforce:marketing_cloud_engagement:*:*:*:*:*:*:*:*before 2026-01-21VulnerableSalesforce
  • cpe:2.3:a:salesforce:marketing_cloud_engagement:*:*:*:*:*:*:*:* Versions before 2026-01-21 Vulnerable ·Salesforce

Remediation

  • Fix · CNA Marketing Cloud Engagement (Salesforce) Fixed in January 21, 2026

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Salesforce Marketing Cloud Engagement January 21, 2026

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2026-18147 Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement…Priority MEDIUM 50
    • TI-2026-18144 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…Priority MEDIUM 50
    • TI-2026-18143 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')…Priority MEDIUM 50
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22585
  2. 2026-10-03 Alias added: GHSA-h763-98v5-2w53

References

Advisory 1

  • TI-2026-18147 Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement… CVSS 3.1CRITICAL 9.8
  • TI-2026-18144 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')… CVSS 3.1CRITICAL 9.8
  • TI-2026-18143 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences