This vulnerability (CVE-2026-22585) in Salesforce Marketing Cloud Engagement arises from the use of a broken or risky cryptographic algorithm (CWE-327). It impacts multiple modules such as CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, and View As Webpage. The flaw enables Web Services Protocol Manipulation, potentially compromising the security of communications and data handled by these modules. The vulnerability affects versions of the service before January 21st, 2026. Salesforce, as the cloud service provider, has released a patch to remediate this issue.

The vulnerability has a critical CVSS score of 9.8, reflecting high impact on confidentiality, integrity, and availability of the affected service. Exploitation could allow attackers to manipulate web service protocols, potentially leading to unauthorized data access or disruption of service. No known exploits are reported in the wild at this time.

Salesforce manages Marketing Cloud Engagement as a cloud service and has released an official patch to address this vulnerability. Customers should ensure their service is updated to the latest version post-January 21st, 2026, as the vendor handles remediation server-side. Check Salesforce advisories for confirmation of patch deployment and no additional action is required beyond applying the vendor's update.