This vulnerability (CWE-88) in Salesforce Marketing Cloud Engagement's MicrositeUrl module involves improper neutralization of argument delimiters, enabling argument injection attacks that manipulate web services protocols. The issue affects all versions prior to January 21, 2026. The CVSS v3.1 base score is 9.8 (critical), indicating network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Salesforce operates this product as a cloud service and has issued a patch to remediate the vulnerability.

Successful exploitation could allow an unauthenticated attacker to manipulate web service commands, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected service. Given the critical CVSS score and the nature of the vulnerability, the impact is severe for users relying on Marketing Cloud Engagement prior to the patch date.

Salesforce manages remediation for this cloud-hosted service and has made a patch available. Customers should verify with Salesforce that their Marketing Cloud Engagement instance is updated to the patched version released on or after January 21, 2026. No additional action is required beyond ensuring the service is up to date as per the vendor advisory.