Attackers Target Salesforce Guest User Misconfigurations
Threat actors launched a mass scanning campaign targeting Salesforce instances with misconfigured guest user settings on March 10, 2026. The attackers systematically probe for overly permissive configurations that allow unauthorized access to sensitive customer data.
Security researchers detected the coordinated scanning activity across multiple Salesforce deployments. The Hacker News reported that attackers specifically target guest user configurations designed for legitimate third-party access but improperly secured by administrators.
Salesforce Customers with Guest User Access at Risk
The campaign affects Salesforce customers who've enabled guest user functionality for external partners or vendors. Organizations using Salesforce Communities, Experience Cloud, or custom portals with guest access face the highest risk.
Companies that haven't properly restricted guest user permissions or implemented adequate access controls are particularly vulnerable. The misconfigured settings allow attackers to access data intended only for authenticated users or specific partner organizations.
Mass Scanning Technique Exploits Configuration Weaknesses
The attackers use automated tools to identify Salesforce instances with exposed guest user endpoints. They probe for common misconfigurations including overly broad data access permissions and insufficient authentication requirements.
The scanning campaign targets publicly accessible Salesforce sites and communities. Attackers look for guest user configurations that grant access to sensitive records, custom objects, or administrative functions without proper restrictions.
