CVE-2026-35178

critical · 9.3

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains remote code execution vulnerability in the timezone conversion flow, which processes attacker-controlled cookie values in an unsafe manner. This vulnerability is fixed in 65.0.0.

9.3

CVSS

0.5%

EPSS (exploit prob.)

41st

EPSS percentile

2026-04-06

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
forceworkbench	forceworkbench	< 65.0.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/forceworkbench/forceworkbench/pull/869
https://github.com/forceworkbench/forceworkbench/security/advisories/GHSA-jw63-m86r-2jxc

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-35178