Workbench contains an unsafe timezone conversion routine that processes cookie values. Maliciously crafted cookies can inject and execute arbitrary code on the server, allowing an attacker to gain full control of the application and potentially the underlying system. This results in a severe confidentiality and integrity compromise.

All installations of the Workbench suite with a version older than 65.0.0 are affected. The flaw exists in the administrative and developer tools that interact with Salesforce.com APIs across the code base prior to the patch. Inventorying Workbench deployments and checking the version number is essential to determine exposure.

The CVSS score of 9.3 classifies this vulnerability as critical, and while no public exploit has been reported and EPSS data is not available, the remote code execution nature means any attacker able to set a malicious cookie on the Workbench instance can exploit the flaw. The likely attack vector is inferred to be a remote web request containing the harmful cookie. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and easy exploitation path warrant urgent attention.