Tableau maintains a focused but strategically prominent portfolio of business-intelligence and data-visualization products, including server, desktop, and reader applications deployed across enterprises for analytics and reporting. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and concentrate through weakness classes including server-side request forgery, authorization bypass, path traversal, and unrestricted file upload that reflect the data-access and file-handling demands of web-based analytics platforms. The exposure pattern recurs across Tableau Server and Desktop variants, making vendor advisories relevant to both centralized deployments and distributed client installations. Defenders should treat this vendor's security updates as part of the analytics infrastructure patch cycle and prioritize internet-facing server instances; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tableau over time
Signals from CVEs in this vendor scope (22 CVEs).
22 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-15637HIGH Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tablea | Aug 26, 2019 | 8.1 | 43 | NO | YES |
CVE-2025-26496CRITICAL Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code | Aug 22, 2025 | 9.3 | 33 | NO | NO |
CVE-2019-19719MEDIUM Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page. | Dec 11, 2019 | 6.1 | 32 | NO | NO |
CVE-2022-22128CRITICAL Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code execution.Tableau only | Oct 17, 2022 | 9.8 | 30 | NO | NO |
CVE-2020-6939CRITICAL Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configu | Nov 23, 2020 | 9.8 | 30 | NO | NO |
CVE-2025-52449HIGH Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due | Jul 25, 2025 | 8.5 | 28 | NO | NO |
CVE-2025-52451HIGH Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.Thi | Aug 22, 2025 | 8.5 | 27 | NO | NO |
CVE-2025-52453HIGH Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tab | Jul 25, 2025 | 8.2 | 27 | NO | NO |
CVE-2025-52452HIGH Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modu | Jul 25, 2025 | 8.5 | 27 | NO | NO |
CVE-2025-52448HIGH Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data | Jul 25, 2025 | 8.1 | 27 | NO | NO |
Signals from CVEs in this vendor scope (22 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tableau.
Media articles that mention a CVE ID that affects a product developed by Tableau — matched by CVE ID, not by vendor name.