This vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) is due to improper neutralization of argument delimiters in commands, enabling argument injection attacks that manipulate web services protocols. The flaw allows an unauthenticated attacker to execute commands that can compromise confidentiality, integrity, and availability of the service. It has a CVSS 3.1 base score of 9.8, indicating critical severity. The issue affects the cloud-hosted service before the patch date of January 21, 2026. Salesforce, as the cloud service provider, has made a patch available to address this vulnerability.

Successful exploitation of this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the Salesforce Marketing Cloud Engagement service. This could allow attackers to manipulate web services protocols, potentially resulting in unauthorized data access, modification, or service disruption. No known active exploits have been reported at this time.

Salesforce manages remediation for this cloud-hosted service and has released an official patch to fix the vulnerability. Users of Marketing Cloud Engagement should ensure their service is updated to the latest version released after January 21, 2026. Check Salesforce's official advisories for confirmation of patch deployment and further guidance.