Salesforce Marketing Cloud Engagement Argument Injection Vulnerability in CloudPagesUrl Module Allowing Web Services Protocol Manipulation
Vulnerability
A vulnerability allowing argument injection has been identified in the CloudPagesUrl module of Salesforce Marketing Cloud Engagement. This issue arises from improper neutralization of argument delimiters, which can be exploited to manipulate web services protocols. The vulnerability affects Marketing Cloud Engagement versions prior to January 21, 2026.
Impact
Exploitation of this vulnerability could lead to unauthorized manipulation of web services protocols, potentially allowing for further attacks or exploitation of other vulnerabilities.
Remediation
Salesforce has deployed a patch for this vulnerability, and Marketing Cloud Engagement customers can ensure they are no longer vulnerable by using links generated after January 21, 2026, at 23:00 UTC.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.