CVE-2026-35178 forceworkbench CVE debrief

Who should care

Administrators and developers using Workbench to interact with Salesforce.com organizations should prioritize updating to version 65.0.0 or later to mitigate this critical vulnerability. Affected operators, platforms, and security teams should review and monitor Workbench usage for potential suspicious activity.

Technical summary

The Workbench suite of tools for Salesforce.com organizations contains a remote code execution vulnerability in its timezone conversion flow. This vulnerability, tracked as CVE-2026-35178, processes attacker-controlled cookie values in an unsafe manner. The issue was addressed in version 65.0.0. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. Affected product deployments should be identified, and owners assigned for follow-up.

Defensive priority

Immediate attention is required to update Workbench to version 65.0.0 or later to prevent potential remote code execution attacks. Additional security measures should be implemented to detect and prevent code execution attempts.

Recommended defensive actions

• Update Workbench to version 65.0.0 or later
• Review and monitor Workbench usage for potential suspicious activity
• Implement additional security measures to detect and prevent code execution attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-04-06T20:16:25.927Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability affects Workbench, a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Evidence of exploitation is not currently available, but defenders should verify affected scope and severity. The CVE record provides limited source detail, and further verification is required to confirm affected deployments.

Official resources