Salesforce
Security Risk Profile
52
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 77 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 25, 2016 to present
77
Total CVEs
32
Critical+High
3
Exploited
29
Unpatched
Threat Assessment
Avg CVSS
7.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
29
Critical/High
Risk Level
52/100
medium
⚠️ 3 Active Exploits
Severity Distribution
Critical
13High
19Medium
13Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
10Age Distribution
Common Weaknesses (CWE)
1
SSRF
6
2
Code Injection
5
3
Path Traversal
5
4
Malicious File Upload
3
5
Input Validation
2
Most Affected Products
1. Tableau Tableau Server43
2. Salesforce Salesforce19
3. Salesforce Tableau Server17
4. Salesforce Marketing Cloud Engagement9
5. Salesforce Mulesoft Anypoint Code Builder6
Recent Vulnerabilities
See more →CVE-2026-34951
CVSS 5.1medium
Reflected XSS in footer.php in Workbench Allows Attackers to Hijack Authenticated Sessions
4/6/2026🔧 No Patch
CVE-2026-2298
CVSS 9.4critical
3/23/2026🔧 No Patch
CVE-2026-22583
CVSS 9.8EPSS 0%critical
1/24/2026🔧 No Patch
CVE-2026-22582
CVSS 9.8EPSS 0%critical
1/24/2026🔧 No Patch
CVE-2026-22586
CVSS 9.8EPSS 0%critical
1/24/2026🔧 No Patch
CVE-2026-22585
CVSS 9.8EPSS 0%critical
1/24/2026🔧 No Patch
CVE-2026-22584
CVSS 9.8EPSS 0%critical
1/9/2026🔧 No Patch
https://www.theregister.com/2025/11/26/gainsight_ceos_handful_customers_data_stolen/
unknown
Gainsight CEO downplays breach, says only a 'handful' of customers had data stolen
11/26/2025🔧 No Patch
https://www.theregister.com/2025/11/21/shinyhunters_salesforce_gainsight_breach/
unknown
ShinyHunters 'does not like Salesforce at all'
11/21/2025⚠ Exploited🔧 No Patch
https://www.theregister.com/2025/11/20/salesforce_gainsight_breach/
unknown
Salesforce-linked data breach claims 200+ victims, has ShinyHunters’ fingerprints all over it
11/20/2025🔧 No Patch
Monitor Salesforce in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.