A set of vulnerabilities in Salesforce Marketing Cloud (SFMC) has drawn attention to security risks associated with the central marketing infrastructure. The vulnerabilities, which affected components related to AMPScript, CloudPages , and email-rendering workflows, could allow attackers to gain access to subscriber information, list marketing emails , and potentially impact organizations across multiple tenants.
Security researchers found that weaknesses in SFMC's templating engine and cryptographic implementation introduced opportunities for unauthorized access to data in customer environments.
AMPScript and SFMC Template Injection Risks
Modern businesses rely heavily on Salesforce Marketing Cloud to manage marketing campaigns , personalized customer journeys , and trackable email communications.
See also: vm2 Node.js: 12 critical vulnerabilities allow sandbox escape
The platform, previously known as ExactTarget, supports dynamic content creation through technologies such as AMPScript, Server-Side JavaScript (SSJS), and internal data views that connect to large subscriber databases. While these features provide flexibility for marketers, the researchers noted that they also increase the impact of any underlying vulnerability.
One of the main issues centered around SFMC’s server-side templating framework. AMPScript and SSJS allow organizations to dynamically insert subscriber attributes like names, email addresses , and engagement metrics directly into marketing content. However, features like TreatAsContent introduced dangerous behavior because they effectively evaluated user-controlled input as executable template code.
The researchers explained that if attacker-controlled data were passed to these functions, it could lead to template injection within Salesforce Marketing Cloud environments. The issue was made more serious because SFMC historically supported executing AMPScript within email subject lines.
According to the findings, the behavior caused subject templates to be evaluated twice by default. This design opened the door for payload execution during the second rendering phase. The researchers demonstrated the vulnerability by using the following payload inside a namespace:
%%=RowCount(LookupRows(“_Subscribers”,”SubscriberKey”,_subscriberkey))=%%
If processed during the second evaluation phase, the payload can be successfully executed and create a reliable injection point within the marketing workflow.
See also: Palo Alto PAN-OS: Critical vulnerability under active exploitation
After successful template execution, attackers could potentially use built-in SFMC functions, such as LookupRows, for internal Data Views, including:
_Subscribers
_Sent
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
_Job
_SMSMessageTracking
_Click
Accessing these views could reveal subscriber lists, email delivery records, engagement metrics, and message history associated with affected Salesforce Marketing Cloud tenants.
CloudPages vulnerability and “View Email in Browser”
Researchers have identified an even more serious vulnerability linked to SFMC’s “view email in browser” functionality and CloudPages infrastructure. Many Salesforce customers configure branded domains such as view.example.com or pages.example.com, which point back to SFMC’s shared infrastructure. These links are typically based on an encrypted qs parameter that contains tenant and message-specific information.
According to researchers from Searchlight Cyber, the older “classic” qs implementation used unauthenticated CBC encryption. The researchers found that the implementation behaved as a padding oracle, which made it possible to decrypt and re-encrypt query string parameters under certain conditions. The researchers initially exploited the vulnerability using the Padre tool, before later improving the process via the AMPScript MicrositeURL function.
This allowed them to create valid QS values and gain access to workflows like “Forward to a Friend,” which could resolve subscriber identifiers to real email addresses.
See also: CISA considers new 3-day deadline to remediate critical vulnerabilities
One of the most concerning elements of the vulnerability was SFMC's use of a static encryption key that was shared between tenants. The researchers said that once the cryptographic structure was understood, attackers could theoretically enumerate subscribers and gain access to email content across multiple organizations using the same mechanism.
Encryption Weaknesses Expanded the Attack Surface
The researchers also discovered an older URL format that relied on per-parameter “encryption.”.
However, the mechanism reportedly consisted of a repeated static XOR key combined with a checksum. Although considered legacy functionality, the researchers found that it still worked on modern SFMC tenants. Because the implementation lacked strong cryptographic protections, attackers could decrypt and enumerate parameters such as JobID and ListSubscriber at high speed, without relying on the slower padding-oracle technique.
The findings highlighted how legacy systems within large cloud platforms can continue to create security breaches long after newer protections are introduced.
Impact of Salesforce Marketing Cloud Vulnerability
The researchers concluded that the combined vulnerabilities could allow attackers to:
- List and export subscriber records
- Gain access to sent marketing emails and engagement data
- Create fake cross-tenant QS tokens
- Gain access to emails belonging to other organizations
- Exploit hard-coded cryptographic material
- Exploit argument-injection vulnerabilities associated with the MicrositeURL function
- Handle CloudPages and other SFMC web workflows
According to Salesforce, the vulnerabilities were reported on January 16, 2026. Mitigations were deployed between January 21 and January 24, 2026.
See also: MetInfo CMS vulnerability exploited for RCE attacks
The company said it had not identified any confirmed malicious exploits at the time of the disclosure. As part of the remediation process, Salesforce migrated its Marketing Cloud Engagement encryption to AES-GCM, rotated encryption keys, and disabled the double-evaluation behavior associated with AMPScript subject-line rendering.
The company also canceled all legacy tracking and CloudPages links created before January 21, 2026 at 23:00 UTC. These links expired globally on January 23, 2026 at 21:00 UTC.
