CVE-2026-22586 is a critical hard-coded cryptographic key flaw (CVSS 9.8) in Salesforce Marketing Cloud Engagement, affecting several web modules in builds before 21 January 2026. It is a hosted service, so the vendor controls the fix. Read the Salesforce help article for any customer steps.
What's affected
Salesforce Marketing Cloud Engagement before 21 January 2026, in these modules: CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center and View As Webpage.
The record points to Salesforce help article 005299346 for details.
How to check if you're exposed
Marketing Cloud Engagement is a hosted service, so there is no package version to read. The date in the record is the cutoff, and the record says the issue affects builds before 21 January 2026.
Confirm in the Salesforce help article whether any action is needed on your account, and whether you use the listed modules.
What to do now
- Read the Salesforce help article named in the record for current guidance.
- List which of the affected modules you use, such as CloudPages or the Subscription Center.
- If the article asks customers to rotate keys, tokens or links, do so and record the date.
- Check public pages built on these modules for anything that carries sensitive values in links.
- Log the vendor side fix in your risk register with the article reference.
Why it matters
The weakness is CWE-321, a hard-coded cryptographic key. A key shipped in code is the same for every deployment, and anyone who finds it can use it to forge or read values the system treats as protected. The record describes the result as web services protocol manipulation.
The record does not describe how the key was found or used and does not say the flaw is exploited in the wild. It is not on the CISA KEV list. Because Salesforce runs the service, your work is mostly to read the advisory and confirm there is nothing for you to do.
Quick check
Do I need to patch anything?
The record says builds before 21 January 2026 are affected, and the service is hosted. Check the Salesforce article for any steps for customers.
What is a hard-coded key?
A secret value written into the product itself, so it is shared by every installation. If it leaks, it cannot be changed without a vendor update.
Sources
Last reviewed: 19 October 2026.
