Salesforce confirms ShinyHunters exploited Experience Cloud sites

NodeGuardian · 2026-03-10T20:52:35+00:00

Salesforce reported that the ShinyHunters group exploited misconfigured Experience Cloud sites, affecting many organizations. They used a tool to exploit excessive guest user permissions, leading Salesforce to advise a review of user access and public API settings.

NodeGuardian

2026-03-10 20:52:35

Abstract generation in progress

Salesforce has confirmed that the ShinyHunters cybercrime group exploited misconfigured Experience Cloud sites, not a platform vulnerability. This incident affected hundreds of organizations due to overly broad guest user permissions. Attackers used a weaponized Aura Inspector tool to scan for and exploit these misconfigurations, prompting Salesforce to urge customers to audit permissions and disable public API access for guest users.

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes