CVE-2026-22585CWE-327

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center…

Critical · published January 24, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
35.8
In the wild
Unconfirmed
What it is

🚨 We're talking about a risky cryptographic algorithm in Salesforce Marketing Cloud that could let attackers manipulate web service protocols — a shocking oversight in a high-stakes environment! 🔥 Think of it like a bank that uses a flimsy lock for its vault; while it may look secure, anyone with the right tools could waltz right in and access valuable assets. This vulnerability allows attackers to exploit weak cryptography as easily as bypassing a poorly designed security measure. If an attacker takes advantage of this vulnerability, they could manipulate web services, potentially leading to unauthorized access to sensitive marketing data and user information. This could result in devastating data breaches and loss of customer trust — a nightmare for businesses relying on this platform!

Put simply

Think of it like a bank that uses a flimsy lock for its vault; while it may look secure, anyone with the right tools could waltz right in and access valuable assets. This vulnerability allows attackers to exploit weak cryptography as easily as bypassing a poorly designed security measure. The vulnerability allows for web services protocol manipulation due to the use of a broken or risky cryptographic algorithm in Salesforce Marketing Cloud Engagement, affecting several modules before January 21st, 2026.

What to do

If an attacker takes advantage of this vulnerability, they could manipulate web services, potentially leading to unauthorized access to sensitive marketing data and user information. This could result in devastating data breaches and loss of customer trust — a nightmare for businesses relying on this platform! To safeguard against this risk, it's crucial to implement better cryptographic practices as soon as possible. Ensure you update to the latest versions of Salesforce Marketing Cloud and follow their security advisories. Regularly audit your cryptographic algorithms and configurations to ensure they meet modern standards! You've got this! Follow these steps to lock down your marketing data and keep your customers safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.8th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-01-24T00:15Z
EPSS history
Timeline
  • 24 JAN 00:15Z
    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center…
    cvelistv5