CVE-2025-26496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-26496", "assignerOrgId": "c9b25dee-ae6d-4083-ba23-638c500cc364", "state": "PUBLISHED", "assignerShortName": "Salesforce", "dateReserved": "2025-02-11T17:18:13.649Z", "datePublished": "2025-08-22T20:10:41.238Z", "dateUpdated": "2026-02-26T17:48:15.308Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["File Upload"], "platforms": ["Windows", "Linux"], "product": "Tableau Server, Tableau Desktop", "vendor": "Salesforce", "versions": [{"lessThan": "2025.1.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2024.2.12", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2023.3.19", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.<p>This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.</p>"}], "value": "Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19."}], "impacts": [{"capecId": "CAPEC-251", "descriptions": [{"lang": "en", "value": "CAPEC-251 Local Code Inclusion"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c9b25dee-ae6d-4083-ba23-638c500cc364", "shortName": "Salesforce", "dateUpdated": "2025-08-22T20:14:03.212Z"}, "references": [{"url": "https://help.salesforce.com/s/articleView?id=005132575&type=1"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2022-1364"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-26496", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-26T03:55:24.875726Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:15.308Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-26496", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-26T03:55:24.875726Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-22T20:43:04.700Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-251", "descriptions": [{"lang": "en", "value": "CAPEC-251 Local Code Inclusion"}]}], "affected": [{"vendor": "Salesforce", "modules": ["File Upload"], "product": "Tableau Server, Tableau Desktop", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.1.3", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2024.2.12", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2023.3.19", "versionType": "semver"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://help.salesforce.com/s/articleView?id=005132575&type=1"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2022-1364"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.", "supportingMedia": [{"type": "text/html", "value": "Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.<p>This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "c9b25dee-ae6d-4083-ba23-638c500cc364", "shortName": "Salesforce", "dateUpdated": "2025-08-22T20:14:03.212Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26496", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:48:15.308Z", "dateReserved": "2025-02-11T17:18:13.649Z", "assignerOrgId": "c9b25dee-ae6d-4083-ba23-638c500cc364", "datePublished": "2025-08-22T20:10:41.238Z", "assignerShortName": "Salesforce"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["File Upload"], "platforms": ["Windows", "Linux"], "product": "Tableau Server, Tableau Desktop", "vendor": "Salesforce", "versions": [{"lessThan": "2025.1.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2024.2.12", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2023.3.19", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@salesforce.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "19541292-4BD4-4BD5-AA68-3836ECC1EBE0", "versionEndExcluding": "2023.3.19", "vulnerable": true}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4AC0483E-569A-497C-BB94-D129FACC17D5", "versionEndExcluding": "2024.2.12", "versionStartIncluding": "2024.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E78711C-389B-4E20-9623-8B0CF6BBCAC8", "versionEndExcluding": "2025.1.3", "versionStartIncluding": "2025.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19."}, {"lang": "es", "value": "La vulnerabilidad de acceso a recursos mediante un tipo incompatible ('Confusi\u00f3n de tipos') en Salesforce Tableau Server, Tableau Desktop en Windows, Linux (m\u00f3dulos de carga de archivos) permite la inclusi\u00f3n de c\u00f3digo local. Este problema afecta a Tableau Server, Tableau Desktop: antes de 2025.1.3, antes de 2024.2.12, antes de 2023.3.19."}], "id": "CVE-2025-26496", "lastModified": "2026-06-17T09:01:55.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-26496", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-26T03:55:24.875726Z", "version": "2.0.3"}}]}, "published": "2025-08-22T21:15:31.103", "references": [{"source": "security@salesforce.com", "tags": ["Vendor Advisory"], "url": "https://help.salesforce.com/s/articleView?id=005132575&type=1"}, {"source": "security@salesforce.com", "tags": ["Technical Description"], "url": "https://www.cve.org/CVERecord?id=CVE-2022-1364"}], "sourceIdentifier": "security@salesforce.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "security@salesforce.com", "type": "Secondary"}]}

{}

{"created": "2025-08-23T11:53:09.843790+00:00", "updated": "2025-08-23T11:53:09.843860+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "microsoft", "microsoft$PRODUCT$windows", "salesforce", "salesforce$PRODUCT$tableau_desktop", "salesforce$PRODUCT$tableau_server", "tableau", "tableau$PRODUCT$tableau_desktop", "tableau$PRODUCT$tableau_server"]}