A hard‑coded cryptographic key is embedded in Salesforce Marketing Cloud Engagement components such as CloudPages and Forward to a Friend. This flaw permits an attacker to craft web service requests that bypass normal security checks, enabling manipulation of the underlying protocol. Consequently, an adversary could read, modify, or delete data that the application handles, compromising confidentiality and integrity of user information.

Salesforce Marketing Cloud Engagement, all releases prior to January 21, 2026, including CloudPages, Profile Center, and related modules.

The vulnerability receives a CVSS score of 9.8, indicating high severity, but the EPSS score sits below 1%, suggesting a low likelihood of exploitation under current conditions. It has not been listed in the CISA KEV catalog. Exploitation would occur remotely through crafted web service requests, exploiting the hard‑coded key to manipulate the protocol and gain unauthorized access.