CVE-2026-34951

CVE-2026-34951 is a reflected cross-site scripting (XSS) vulnerability affecting Salesforce Workbench, a suite of administrative and developer tools for interacting with Salesforce organizations via Force.com APIs. The vulnerability exists in versions prior to 65.0.0 and stems from unsanitized user input in the footerScripts parameter, which allows attackers to inject malicious scripts that execute in users' browsers when rendering error pages. The vulnerability carries a CVSS severity rating of 6.1 (Medium) with a network-based attack vector requiring no special privileges but necessitating user interaction. The attack has limited scope but can result in confidentiality and integrity compromises, such as session hijacking or credential theft. The EPSS score of 0.00033 indicates this vulnerability is among the less frequently targeted exploits in the wild. There is no evidence of active exploitation in the wild, and the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog. No publicly available exploit code has been identified, and community attention appears minimal based on its inactive status on threat tracking lists. Organizations running Workbench should upgrade to version 65.0.0 or later to remediate this issue, though the low exploitation probability suggests this is not an urgent emergency response priority.