The vulnerability is an improper neutralization of argument delimiters in a command, classified as argument injection. Attackers can manipulate web services protocol commands allowing unauthorized actions or potentially executing arbitrary code. The weakness corresponds to CWE-88 and results in confidentiality or integrity compromise if exploited successfully.

The affected system is Salesforce Marketing Cloud Engagement, specifically the MicrositeUrl module. All instances running versions published before January 21, 2026 are potentially vulnerable. No other vendors or product versions are listed as affected.

The CVSS score of 9.8 marks this as critical, and although EPSS is low (<1%), the possibility of exploitation exists, especially for privileged users or exposed services. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote via web services, with the attacker needing to craft requests that insert unneutralized delimiters into command arguments. Successful exploitation would grant the attacker elevated privileges or command execution within the service context.