CVE-2026-35178

CVE-2026-35178 is a remote code execution vulnerability in Salesforce Workbench versions prior to 65.0.0, a suite of administrative and developer tools for interacting with Force.com APIs. The vulnerability exists in the timezone conversion flow, which improperly processes attacker-controlled cookie values without adequate safeguards. This flaw has been remediated in version 65.0.0 and later. The vulnerability carries a CRITICAL CVSS v3.1 score of 9.8, reflecting its severe nature across all dimensions. The attack requires only network access with no special privileges or user interaction, making it trivially exploitable. Successful exploitation grants attackers complete system compromise, including confidentiality, integrity, and availability breaches. There is currently no evidence of active exploitation in the wild, and the vulnerability does not appear on the KEV catalog or hot exploit lists. However, the relatively straightforward attack vector and network accessibility suggest organizations should prioritize patching to version 65.0.0 or later as a high-priority security action. The EPSS score of 0.003 indicates lower predicted likelihood of near-term exploitation compared to the broader CVE population.