CVE-2026-35178

CRITICAL

Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion

Title source: cna
STIX 2.1

Description

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains remote code execution vulnerability in the timezone conversion flow, which processes attacker-controlled cookie values in an unsafe manner. This vulnerability is fixed in 65.0.0.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0049
EPSS Percentile 38.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (1)
forceworkbench/forceworkbench < 65.0.0 (2 CPE variants)
Published Apr 06, 2026
Tracked Since Apr 07, 2026