CVE-2026-35178

CriticalCVSS 9.8

Published: 06/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

39th percentile - higher than 39% of all known CVEs

Summary

Workbench prior to version 65.0.0 contains a remote code execution vulnerability in the timezone conversion flow. The vulnerability is due to unsafe processing of attacker-controlled cookie values.

Risk Assessment

An attacker can remotely execute arbitrary code on the server, leading to full system compromise.

Recommendation

Upgrade Workbench to version 65.0.0 or later.

Original NVD description (English source)

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains remote code execution vulnerability in the timezone conversion flow, which processes attacker-controlled cookie values in an unsafe manner. This vulnerability is fixed in 65.0.0.