Salesforce Marketing Cloud Patches Critical Vulnerabilities Exposing Subscriber Data Salesforce recently addressed a series of high-severity vulnerabilities in its Marketing Cloud (SFMC) platform that could have allowed attackers to access and exfiltrate marketing emails, subscriber records, and engagement data across multiple tenants including Fortune 500 organizations. The flaws stemmed from weaknesses in SFMC’s server-side templating and encryption mechanisms. AMPScript and SSJS, used for dynamic email personalization, included functions like TreatAsContent that enabled template injection. Attackers could exploit this by embedding malicious payloads in user-controlled fields (e.g., name fields), which would execute during template evaluation. Once injected, built-in functions like LookupRows allowed queries against internal data views, exposing subscriber lists, sent emails, and tracking data. A more severe issue involved SFMC’s "view email in browser" and CloudPages features, which relied on encrypted query strings (qs parameters) to authenticate users. Researchers at Searchlight Cyber discovered that the older "classic" qs format used unauthenticated CBC encryption with a padding oracle vulnerability, enabling decryption and re-encryption of parameters. Additionally, a legacy XOR-based encryption scheme with a static key allowed rapid decryption of sensitive identifiers like JobID and ListSubscriber. Since SFMC reused a single static encryption key across tenants, attackers could forge qs tokens to access emails and subscriber data from other organizations. The vulnerabilities, reported on 16 January 2026, were mitigated between 21–24 January 2026. Salesforce migrated to AES-GCM encryption, rotated keys, disabled double evaluation of email subject templates, and invalidated all legacy tracking and CloudPages links created before 21 January 2026 (23:00 UTC). No confirmed malicious exploitation was reported. The incident underscores risks in shared SaaS infrastructure, where template engines and cryptographic flaws can expose high-value marketing data at scale. Salesforce assigned multiple CVEs to address broken encryption, hard-coded keys, and argument injection in MicrositeURL and CloudPages workflows.