CVE-2026-22585: Salesforce Marketing Cloud Engagement - Risky Cryptographic Algorithm (CWE-327)
CVE-2026-22585 affects Salesforce Marketing Cloud Engagement before 2026-01-21 and is classified as CWE-327, a weakness involving a risky cryptographic algorithm. The CNA and CISA-ADP both score it 9.8 under CVSS 3.1, while the record shows no KEV listing and no confirmed exploitation in the sources consulted. No fixed version is listed in the available record, so the vendor advisory should be reviewed.
Overview
CVE-2026-22585 is a critical issue in Salesforce Marketing Cloud Engagement, classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). According to the record, the flaw affects the CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center and View As Webpage modules and allows Web Services Protocol Manipulation.
Impact
The CNA and CISA-ADP both score the issue at 9.8 under CVSS 3.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable flaw requiring no privileges or user interaction, with high impact on confidentiality, integrity and availability. The SSVC data in the record rates technical impact as total and automatable as yes. These values are taken from the record and were not independently verified against the vendor advisory.
Affected products and versions
- Product: Salesforce Marketing Cloud Engagement
- Affected: before 2026-01-21, as recorded in the affected list
- Fixed versions: not listed in the available record
The record expresses the affected boundary as a date. Check the vendor advisory for the exact scope of the fix for your deployment.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record, and SSVC exploitation is recorded as none. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00425 with a percentile of 0.35771, dated 2026-10-23 in the record. EPSS estimates likelihood and does not confirm activity.
Remediation and mitigation
- Review the vendor advisory linked in the record and confirm whether your Marketing Cloud Engagement environment falls within the stated scope.
- Confirm with the vendor that the platform change addressing this issue has been applied to your environment, since no fixed version is listed in the record.
- Where business needs allow, limit exposure of the listed modules and review who can access and configure them.
- Monitor the advisory for updates.
Detection guidance
- Review web service and module access logs for unusual request patterns directed at the listed modules, at a general level.
- Watch for unexpected configuration changes in CloudPages and subscription-related features.
- Escalate anomalies to your vendor support channel and to your incident response team.
Limitations of the available information
The record does not include a fixed version, a detailed technical description of the cryptographic weakness, or workarounds beyond the advisory link. The CWE name describes the weakness class rather than the specific algorithm involved. The title was missing in the source and was written from the description. Whether customers must take action beyond platform changes is unknown from the record.
Frequently asked questions
Is CVE-2026-22585 confirmed as actively exploited?
No. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which Salesforce Marketing Cloud Engagement versions are affected?
The record lists the product as affected before 2026-01-21. No fixed version is given in the available record, so the vendor advisory should be checked.
How severe is this vulnerability?
The CNA and CISA-ADP both assign a CVSS 3.1 base score of 9.8, which is rated critical in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.