CVE-2026-22586
published 2026-01-24CVE-2026-22586: Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center…
PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.61%
44.9th percentile
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| salesforce | marketing_cloud_engagement | < January 21, 2026 | January 21, 2026 |
| salesforce | marketing_cloud_engagement | < 2026-01-21 | 2026-01-21 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Salesforce Marketing Cloud Engagement hard-coded key (EUVD-2026-4597)
vuldb·2026-05-17·CVSS 9.8
CVE-2026-22586 [CRITICAL] Salesforce Marketing Cloud Engagement hard-coded key (EUVD-2026-4597)
A vulnerability identified as problematic has been detected in Salesforce Marketing Cloud Engagement. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in use of hard-coded cryptographic key
.
This vulnerability is identified as CVE-2026-22586. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
GHSA-83vr-2q27-pm8v: Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Cen
ghsa_unreviewed·2026-01-24
CVE-2026-22586 [CRITICAL] CWE-321 GHSA-83vr-2q27-pm8v: Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Cen
Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.
No detection rules found.
No public exploits indexed.
2026-01-24
Published