CVE-2026-22584: Salesforce Uni2TS Code Injection Vulnerability
CVE-2026-22584 is a code injection weakness (CWE-94) in Salesforce Uni2TS, described for macOS, Windows and Linux, affecting versions through 1.2.0. The CNA and CISA ADP both score it 9.8 (critical) under CVSS 3.1 with a network-reachable, no-privilege, no-user-interaction vector. The record shows no KEV listing and no confirmed exploitation in the sources consulted.
Overview
The CVE record describes a code injection weakness (CWE-94) in Salesforce Uni2TS, which the record lists for macOS, Windows and Linux. The description states that the issue affects Uni2TS through 1.2.0. The CNA is Salesforce and the record links a vendor advisory.
Impact
The CVSS 3.1 vector supplied by the CNA is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (critical). According to that vector, the flaw is reachable over the network, needs no privileges or user interaction, and carries high impact on confidentiality, integrity and availability. The record does not describe concrete consequences beyond this scoring.
Affected products and versions
- Product listed: Salesforce Uni2ts
- Ranges listed: before 2.0.0, and through 1.2.0
- The record uses 1.2.0 and 2.0.0 as the boundary versions.
Exploitation status
The CISA KEV entry in the record is not listed, and no confirmed exploitation appears in the sources consulted. The SSVC data in the record lists exploitation as none and automatable as yes, which describes exposure rather than observed attacks.
Remediation and mitigation
- Identify all Uni2TS installations on macOS, Windows and Linux systems and compare their versions with the ranges above.
- Review the Salesforce vendor advisory linked in the record for the fixed version and upgrade instructions. The record itself does not name a fix.
- Where upgrading is not immediately possible, limit exposure of the affected component and restrict who can supply inputs to it, based on the vendor guidance.
Detection guidance
- Review inventories and software manifests to find affected Uni2TS versions.
- Monitor for unexpected process creation or code loading originating from Uni2TS components.
- Track changes to files handled by the component and investigate unusual writes or executable content in non-executable file types.
Limitations of the available information
The record has no fix entries, no detailed technical write-up, and only one vendor reference. The description is brief and does not explain the precise input path or preconditions beyond what the CVSS vector implies. The EPSS data is included as recorded, with a date later than the publication date, so its timing should be verified.
Frequently asked questions
What is CVE-2026-22584?
It is a code injection weakness (CWE-94) in Salesforce Uni2TS, described for macOS, Windows and Linux and affecting versions through 1.2.0.
How severe is it according to the record?
The CNA and CISA ADP both assign a CVSS 3.1 base score of 9.8, which is rated critical, with a network attack vector and no privileges or user interaction required.
Is it known to be exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.