CVE-2026-22584: Code Injection in Salesforce Uni2TS

The impact of this Code Injection vulnerability is significant. An attacker could leverage this flaw to execute arbitrary code on the affected system with the privileges of the Uni2TS process. This could lead to data theft, system takeover, and lateral movement within the network. The ability to inject code into non-executable files bypasses typical security controls, making exploitation more likely. Successful exploitation could grant an attacker persistent access and control over the compromised system, potentially impacting sensitive Salesforce data and infrastructure.

1. Reserved2026-01-07
2. Published2026-01-10
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-22584 is to upgrade Salesforce Uni2TS to version 2.0.0 or later, which contains the fix. If an immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing strict file access controls to prevent unauthorized modification of non-executable files. Monitor system logs for suspicious activity related to Uni2TS processes. While a WAF is unlikely to directly mitigate this vulnerability, network segmentation can limit the blast radius of a successful attack. After upgrading, confirm the fix by attempting to trigger the vulnerability and verifying that the code injection is prevented.