Read the docs
TI-2026-27175 Aliases CVE-2026-34951

Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages. This vulnerability is fixed in 65.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed forceworkbench (forceworkbench): 65.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
forceworkbenchforceworkbenchbefore 65.0.065.0.0Patch availableCNA
  • forceworkbench Vendorforceworkbench Affected before 65.0.0 Fixed in 65.0.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:salesforce:workbench:*:*:*:*:*:*:*:*before 65.0.0VulnerableSalesforce
  • cpe:2.3:a:salesforce:workbench:*:*:*:*:*:*:*:* Versions before 65.0.0 Vulnerable ·Salesforce

Remediation

  • Fix · CNA forceworkbench (forceworkbench) Fixed in 65.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34951

References

Advisory 1

  • TI-2026-27332 Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences