« Volver al listado

CVE-2026-22583

Estado: AnalizadaCrítica (9.8)—

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:N sin UI:R indica explotación remota sin autenticación (T1190). CWE-88 (argument injection) permite ejecución de comandos arbitrarios (T1059) y manipulación de datos en el servicio web (T1565.002).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (1)

Salesforce — Marketing Cloud Engagement

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22583",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22583",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-27T04:55:33.618713Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@salesforce.com",
      "affectedData": [
        {
          "vendor": "Salesforce",
          "modules": [
            "CloudPagesUrl"
          ],
          "product": "Marketing Cloud Engagement",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "January 21, 2026",
              "versionType": "date"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-24T01:15:50.060",
  "references": [
    {
      "url": "https://help.salesforce.com/s/articleView?id=005299346&type=1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@salesforce.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@salesforce.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Neutralización Inadecuada de Delimitadores de Argumentos en un Comando ('Inyección de Argumentos') en Salesforce Marketing Cloud Engagement (módulo CloudPagesUrl) permite la Manipulación del Protocolo de Servicios Web. Este problema afecta a Marketing Cloud Engagement: antes del 21 de enero de 2026."
    }
  ],
  "lastModified": "2026-06-17T10:20:06.663",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:salesforce:marketing_cloud_engagement:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A41CCDE-A5EA-45D6-A009-A6908459C453",
              "versionEndExcluding": "2026-01-21"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@salesforce.com"
}