Improper neutralization of argument delimiters in Salesforce Marketing Cloud Engagement’s command processing enables attackers to inject malicious content via crafted web service requests. The injected delimiters cause the platform to treat the payload as additional command arguments, allowing unintended command execution that can compromise confidentiality, integrity, or availability. This flaw is identified as a command injection weakness (CWE‑88).

The vulnerability affects all Salesforce Marketing Cloud Engagement releases dated before January 30, 2026. No further version details are provided, so any instance predating that date is considered vulnerable. The product in question is Salesforce Marketing Cloud Engagement.

The vendor assigns a CVSS score of 9.4, indicating critical severity with full network reach and high impact. The current exploit probability is below 1 %, and the flaw is not listed in the known exploited vulnerabilities catalog. The likely attack vector is remote, through the web services API, where malformed request payloads trigger injection. No explicit authentication requirement is mentioned, suggesting that any entity able to access the API could potentially exploit the flaw. The combination of high severity and remote accessibility warrants urgent remediation.