CVE Intelligence
Analysis AI-assisted

CVE-2026-22582: Salesforce Marketing Cloud Engagement MicrositeUrl Argument Injection

CVE-2026-22582 is an argument injection weakness (CWE-88) in the MicrositeUrl module of Salesforce Marketing Cloud Engagement, according to the CNA record. The CNA states that it affects versions before 2026-01-21 and that it allows Web Services Protocol Manipulation. The record lists a CVSS 3.1 base score of 9.8 (critical), but it contains no fixed version and no confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Salesforce published a CNA record for CVE-2026-22582, an argument injection weakness (CWE-88) in the MicrositeUrl module of Marketing Cloud Engagement. The record places the affected range before 2026-01-21.

Impact

  • The CNA describes the issue as allowing Web Services Protocol Manipulation.
  • The record lists a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, provided by the CNA and by CISA-ADP.
  • Based on that vector, the attack is network-reachable, needs no privileges or user interaction, and carries high impact to confidentiality, integrity and availability (inference from the vector).

Affected products and versions

  • Salesforce Marketing Cloud Engagement, before 2026-01-21.
  • The record contains no fixed version. This does not mean no fix exists; check the vendor advisory.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source.
  • The SSVC exploitation value is none, and the EPSS probability is 0.00647. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the Salesforce vendor advisory for the remediation steps and for the status of your Marketing Cloud Engagement environment.
  • Marketing Cloud Engagement is a Salesforce-managed service, so confirm with Salesforce whether your instance is covered (inference).
  • As general defense in depth, limit who can reach the web service endpoints used by the MicrositeUrl module and monitor them for anomalous use.

Detection guidance

  • Review web service and integration logs for requests with unexpected structure or parameter values that reach the MicrositeUrl functionality.
  • Alert on spikes in errors or unusual sources accessing these endpoints.

Limitations of the available information

  • The record has no fixed version and no advisory text beyond the reference link.
  • The exact technical conditions and the full scope of impact are not described in the record.
  • The EPSS date in the record (2026-10-23) is later than the publication date, so its timing should be verified against the FIRST source.

Frequently asked questions

What is CVE-2026-22582?

It is an argument injection weakness (CWE-88) in the MicrositeUrl module of Salesforce Marketing Cloud Engagement, as described by the CNA Salesforce record.

Which versions are affected?

The record states that versions before 2026-01-21 are affected. The record does not list a fixed version.

Is this vulnerability known to be exploited?

The record shows it is not listed in CISA KEV and that the SSVC exploitation value is none. No confirmed exploitation appears in the sources consulted.

What should administrators do now?

Review the Salesforce vendor advisory, confirm with Salesforce whether your instance is covered, and restrict and monitor access to the affected web service endpoints.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.