CVE-2026-34951 Salesforce CVE debrief

Who should care

Defenders and administrators of Salesforce Workbench should assess exposure and apply the fixed version to prevent cross-site scripting attacks. They should also review and update inventory to ensure all Workbench instances are up-to-date and verify exposure by checking if the current Workbench version is prior to 65.0.0.

Why it matters

CVE-2026-34951 is a reflected cross-site scripting vulnerability in Salesforce Workbench, which allows for cross-site scripting targeting error pages. Defenders should prioritize verifying exposure and applying the fixed version 65.0.0.

• Defenders should verify exposure and apply the fixed version to prevent cross-site scripting attacks.
• The vulnerability allows for cross-site scripting targeting error pages, which can lead to security incidents.
• Defenders should review and update inventory to ensure all Workbench instances are up-to-date.

Technical summary

The vulnerability is a reflected cross-site scripting vulnerability via the footerScripts parameter in Workbench, which does not sanitize user-supplied input before rendering it in the page response. This allows for cross-site scripting targeting error pages. The vulnerability has a CVSS score of 5.1 and is fixed in version 65.0.0. Defenders should prioritize verifying exposure and applying the fixed version 65.0.0, as the vulnerability allows for cross-site scripting targeting error pages. Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs.

Defensive priority

Defenders should prioritize verifying exposure and applying the fixed version 65.0.0, as the vulnerability allows for cross-site scripting targeting error pages.

Recommended defensive actions

• Verify exposure by checking if the current Workbench version is prior to 65.0.0.
• Apply the fixed version 65.0.0 to prevent cross-site scripting attacks.
• Review and update inventory to ensure all Workbench instances are up-to-date.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its impact, and the fixed version. A vendor advisory is also available on GitHub. Defenders should verify exposure by checking if the current Workbench version is prior to 65.0.0 and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.