Tableau Server

Vendor:

First CVE: Aug 26, 2019 · Active for 6 years

22
Total CVEs
More Total CVEs than 94% of tracked products
4.4
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Tableau Server over time

Volume of CVEsAvg CVSS Base Score
First CVE
Aug 26, 2019
6 years ago
Most Recent CVE
Aug 22, 2025
336 days ago

CVE Severity & Scoring

Tableau Server22 CVEs
All CVEs352,294 CVEs
MediumHighCritical
Attack Vector
Local1 (4.5%)
Network18 (81.8%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network3 (13.6%)
Attack Complexity
Low20 (90.9%)
High2 (9.1%)
Unknown0 (0.0%)
User Interaction
None17 (77.3%)
Unknown0 (0.0%)
Required5 (22.7%)
Privileges Required
Low7 (31.8%)
High1 (4.5%)
None14 (63.6%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (22 CVEs).

22 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2019-15637HIGH
Numerous Tableau products are vulnerable to XXE via a malicious workbook, extension, or data source, leading to information disclosure or a DoS. This affects Tableau Server, Tablea
Aug 26, 20198.143NOYES
CVE-2025-26496CRITICAL
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code
Aug 22, 20259.333NONO
CVE-2019-19719MEDIUM
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
Dec 11, 20196.132NONO
CVE-2022-22128CRITICAL
Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could allow remote code execution.Tableau only
Oct 17, 20229.830NONO
CVE-2020-6939CRITICAL
Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users. If exploited, this could allow a malicious user to configu
Nov 23, 20209.830NONO
CVE-2025-52449HIGH
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due
Jul 25, 20258.528NONO
CVE-2025-52451HIGH
Improper Input Validation vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - create-data-source-from-file-upload modules) allows Absolute Path Traversal.Thi
Aug 22, 20258.527NONO
CVE-2025-52453HIGH
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tab
Jul 25, 20258.227NONO
CVE-2025-52452HIGH
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modu
Jul 25, 20258.527NONO
CVE-2025-52448HIGH
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data
Jul 25, 20258.127NONO
View all 22 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (22 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
4.5% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (22 CVEs).

Media Mentions

Signals from CVEs in this product scope (22 CVEs).

Top CNAs Publishing CVEs For Tableau Server

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
10.517.51.2%00