Salesforce is actively monitoring threat activity targeting public-facing Experience Cloud sites, including attempts to take advantage of overly permissive guest user configurations.

At this time, we have not identified any vulnerability inherent to the Salesforce platform associated with this activity. These attempts are focused on customer configuration settings that, if not properly secured, may increase exposure.

We encourage customers to review their Experience Cloud guest user settings and take immediate recommended actions. For additional details and steps to help protect your org, please see our blog: https://www.salesforce.com/blog/protecting-your-data-essential-actions-to-secure-experience-cloud-guest-user-access/

Security Advisory: Protecting Experience Cloud Sites from Guest User Misconfigurations 

Salesforce is actively monitoring threat activity targeting public-facing Experience Cloud sites, including attempts to take advantage of overly permissive guest user configurations.

We have identified additional guidance for customers to help protect their orgs. Please see our updated blog for recommended actions: https://www.salesforce.com/blog/protecting-your-data-essential-actions-to-secure-experience-cloud-guest-user-access/

At this time, we have not identified any vulnerability inherent to the Salesforce platform associated with this activity.

Update

Salesforce is aware of and closely monitoring a phishing campaign appearing as fraudulent emails from Salesforce with a malicious link to download Remote Monitoring & Management (RMM) software.

Our security teams are working diligently to contain this issue and urge all customers to maintain a high level of vigilance against phishing and social engineering attempts, as these remain frequently used tactics by threat actors. If you receive requests from Salesforce to install RMM software, we recommend you validate its legitimacy with Salesforce Support or architect teams prior to taking action by opening up a ticket through the Salesforce Help portal.

For guidance and support, please reach out through the Salesforce Help portal. You can also refer to this article for guidance on how to protect your environments from social engineering threats: https://www.salesforce.com/blog/protect-against-social-engineering/. 

Security Alert: Phishing Campaign with Malicious links

We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.
Our security teams are actively working to protect customer environments and data, providing guidance and support. Customers identified as potentially affected have been notified directly. If you have not received a notification, we currently have no evidence suggesting any impact to your account. We continue to monitor the situation closely and encourage customers to remain vigilant against phishing and social engineering attempts, which remain common tactics used by threat actors.

For guidance, please review our blog post (https://www.salesforce.com/blog/protect-against-social-engineering), knowledge article (https://help.salesforce.com/s/articleView?id=005226734&type=1), and reach out through the Salesforce Help portal if you need support.

Security Advisory: Ongoing Response to Social Engineering Threats

Salesforce is monitoring social engineering campaigns targeting third-party identity providers (IdPs) across the industry. In these attacks, threat actors use fraudulent login pages or impersonate IT support through voice calls to steal credentials or MFA codes, or to trick users into authorizing malicious connected apps. If an IdP account is compromised, attackers may attempt to access connected applications.

Please note this issue does not stem from a vulnerability inherent to Salesforce; these attacks rely on social engineering and deceptive authentication prompts.

Our security teams are actively working to protect customers and have notified potentially affected accounts. For guidance and mitigations, please review our blog post (https://www.salesforce.com/blog/protecting-salesforce-data-after-an-identity-compromise/) and knowledge article (https://help.salesforce.com/s/articleView?language=en_US&id=005226734&type=1). For support, contact Salesforce Customer Support via https://help.salesforce.com/s/?language=en_US.

We want to inform our customers about a recent security incident involving the Drift app, published by Salesloft, that was installed by individual customers. Salesforce security teams detected unusual activity that may have resulted in unauthorized access to a small number of customers’ orgs data via the app's connection to Salesforce.

It is important to note that this issue did not stem from a vulnerability within the core Salesforce platform, but rather from a compromise of the app's connection.

Upon detecting the activity, Salesloft, in collaboration with Salesforce, invalidated active Access and Refresh Tokens, and removed Drift from AppExchange. We then notified affected customers.

We’re continuing to work with Salesloft as part of our investigation and provide updates as appropriate, including notifying and supporting affected customers with remediation. If you need support, please reach out through Salesforce Help: https://help.salesforce.com/s. 

Security Advisory: Unusual Activity in a Third Party Connected App

Salesforce has re-enabled integrations with Salesloft technologies, with the exception of any Drift app. Drift will remain disabled until further notice as part of our continued response to the security incident. This decision follows security measures and remediation steps implemented by Salesloft, which were independently validated by Mandiant.

For full details and guidance from Salesforce, please continue to follow https://help.salesforce.com/s/articleView?id=005134951&type=1. 
For Salesloft’s latest investigation and remediation updates, see https://trust.salesloft.com/?uid=Update+on+Mandiant+Drift+and+Salesloft+Application+Investigations

Salesforce has disabled all integrations between Salesforce and Salesloft technologies, including the Drift app. As a result, organizations will not be able to connect to Salesforce via any Salesloft apps until further notice. Our teams are continuing to assess the situation, and we will provide further updates as appropriate. 

For additional details, including guidance and future updates, please visit our knowledge article: https://help.salesforce.com/s/articleView?id=005134951&type=1.

To protect our customers, Salesforce has disabled the connection between the Drift app, published by Salesloft, and Salesforce as part of our response to the recent security incident. This issue is limited to the Drift app’s connection and did not arise from a vulnerability within the Salesforce platform.

On August 28, 2025, at 04:09 UTC, we took this action out of an abundance of caution and as part of our ongoing security investigation. As a result, customers will not be able to connect to Salesforce via the Drift app until further notice.

Disabling the connection is a precautionary measure to help safeguard customer environments while we continue to assess and address the situation. We recognize this change may cause disruption and will provide further updates as more information becomes available.

For additional details, please visit: https://help.salesforce.com/s/articleView?id=005134951&type=1

Salesforce takes its sanctions and export control obligations seriously, and we require our customers and partners to do the same. Under current United States, European Union, and United Kingdom sanctions, the provision of enterprise management software to individuals or entities in Russia is prohibited. 

Until further notice, we expect our customers and partners will not provide access to Salesforce products and services to their users or affiliates in Russia without appropriate legal authorization. Salesforce may implement technical access controls to support compliance with applicable laws, including as per compliance with OFAC’s Determination Pursuant to Section 1(a)(ii) of Executive Order 14071, European Union Council Regulation 2023/2878, and the United Kingdom Russia (Sanctions) (EU Exit) (Amendment) Regulations 2025.

If your organization requires access to Salesforce products or services in Russia, please contact your Salesforce account team to discuss our exceptions process.


VÅRT VÄRDE

Vi agerar som betrodda rådgivare.

Vi får våra kunders, anställdas och utökade familjs förtroende genom transparens, säkerhet, överensstämmelse, integritet och prestanda. Vi levererar branschens mest betrodda infrastruktur.

Status efter produkt

Informationsmeddelande

Trust-komponenter

Resurser