External risk intelligence

Workbench Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-35178

Workbench is a web-based tool designed for administrators and developers to interact with Salesforce APIs. It is commonly deployed as a web application or hosted instance to provide remote access to these management interfaces, making it a likely target for internet-facing exposure.

Code Injection

Forceworkbench

before 65.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Salesforce Workbench tool that could allow an attacker to execute code remotely if a user interacts with a specially crafted cookie. This issue is present in versions prior to 65.0.0 and has been addressed in the latest release.

Remote code execution flaw in admin tool.
Affects how administrators manage Salesforce.
Confirm relevance and exposure to Salesforce tools.

Attack Path

How an attacker could exploit the issue

An attacker could reach and trigger this vulnerability by presenting a specially crafted cookie to a user interacting with Workbench. This interaction could lead to remote code execution if the vulnerable timezone conversion flow processes the malicious cookie value.

Unauthenticated user interaction required.
Unsafe processing of attacker-controlled cookie.
Potential for remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a remote code execution vulnerability in the timezone conversion flow could affect system data and service behavior due to unsafe processing of attacker-controlled cookie values.

System data and configuration could be affected.
Attackers could exploit unsafe cookie processing.
Malicious code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Workbench, a suite of tools for interacting with Salesforce.com organizations. The first practical step is to identify all instances of Workbench, confirm their accessibility and business criticality, and then assign ownership for remediation planning.

Identify Workbench instances and ownership.
Verify exposure and business criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Workbench?

Workbench is a web-based suite of tools that developers and administrators use to interact with Salesforce organizations. It provides a specialized interface for performing operations through Force.com APIs, such as data manipulation, testing, and debugging. Because it acts as an administrative gateway, it is often deployed as a web application or hosted instance to provide remote management capabilities for Salesforce environments.

What does CWE-94 mean for CVE-2026-35178?

CWE-94 refers to improper control of generation of code, commonly known as code injection. In this specific case, the vulnerability exists within the application's timezone conversion flow. Because the software processes cookie values provided by an external source without sufficient validation, it can be tricked into executing unintended commands or code on the server hosting the tool.

How is this Workbench vulnerability triggered?

The vulnerability is triggered when the application processes a specially crafted cookie. An attacker must successfully deliver this malicious cookie to a user who is interacting with the Workbench tool. Importantly, normal, legitimate use of timezone features that do not involve manipulated cookie data will not trigger the execution of malicious code; the attack specifically relies on the unsafe handling of the controlled input during the conversion process.

Is my instance of Workbench at risk?

Halo Surface Signal notes that because Workbench provides remote access to Salesforce management interfaces, it is often hosted as an internet-facing application, making it a likely target for external discovery. You should assess whether your deployment is reachable from the public internet or if it is restricted to internal network segments, as internet-facing instances are generally at a higher risk of being targeted by this vulnerability.

How do I secure my systems against this?

The primary step is to identify all running instances of Workbench within your environment and verify their current version. If your installation is prior to 65.0.0, you must update the software to version 65.0.0 or later to apply the fix. Begin by mapping your instances, determining which are business-critical, and coordinating with the infrastructure owners to ensure the update is applied promptly.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.