Exposición de Salesforce

CRM
80
score de exposición
100.732
sitios usan
0
en explotación
8
críticos
Análisis Vexday

Com 34 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o Salesforce apresenta uma taxa de exploração abaixo da média geral do catálogo, o que sugere menor pressão ofensiva imediata sobre essa plataforma. Ainda assim, 8 falhas classificadas como críticas merecem atenção contínua de equipes de segurança, especialmente em ambientes que dependem de integrações e dados sensíveis. O maior índice EPSS observado é 0.00659, registrado na CVE-2026-22582, indicando probabilidade relativamente baixa de exploração no curto prazo, mas sem descartá-la completamente. A ausência de novas CVEs nos últimos 90 dias e o predomínio de falhas do tipo CWE-1427 orientam equipes de resposta a priorizarem a revisão de controles associados a esse padrão de fraqueza específico.

CVEs

34 resultados
CVE-2026-22583CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CEPSS 0.7%CVE-2026-22582CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MEPSS 0.7%CVE-2026-22586CRITICALHard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, SubscrEPSS 0.6%CVE-2025-26494HIGHServer Side Request Forgery vulnerability in Tableau ServerEPSS 0.5%CVE-2025-43698CRITICALImproper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for SEPSS 0.5%CVE-2025-9844HIGHUncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects EPSS 0.4%CVE-2026-22585CRITICALUse of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, PrEPSS 0.4%CVE-2025-43697HIGHImproper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmnEPSS 0.4%CVE-2025-43701HIGHImproper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data.  This impaEPSS 0.4%CVE-2025-52452HIGHImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux EPSS 0.4%CVE-2026-2298CRITICALImproper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement alEPSS 0.4%CVE-2025-43700HIGHImproper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.  This impacts OmEPSS 0.4%CVE-2025-52450MEDIUMImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux EPSS 0.4%CVE-2025-43699MEDIUMClient-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission checEPSS 0.4%CVE-2026-22584CRITICALImproper Control of Generation of Code ('Code Injection') vulnerability in Salesforce Uni2TS on MacOS, Windows, Linux allows Leverage ExecutEPSS 0.4%CVE-2025-52447HIGHAuthorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc commanEPSS 0.3%CVE-2024-32148MEDIUMWordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-52448HIGHAuthorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api moduEPSS 0.3%CVE-2025-26495HIGHSensitive Data Exposure in Tableau ServerEPSS 0.3%CVE-2025-52455MEDIUMServer-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource LocatioEPSS 0.3%