Vulnerability · Published Aug 22, 2025 · Assigned by Salesforce
CVE-2025-26496
Critical 9.3
In plain English
A critical-severity type confusion in Tableau Server, Tableau Desktop from Salesforce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Salesforce | Tableau Server, Tableau Desktop | 0 – before 2025.1.30 – before 2024.2.120 – before 2023.3.19 |
Weakness: CWE-843 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H