Breaches and incidentsBriefReported by a reputable outlet, citing the company
Salesforce Experience Cloud: mass scanning of misconfigured guest-user sites with a modified AuraInspector
Salesforce confirmed a campaign in which attackers mass-scanned public Experience Cloud sites, probed the /s/sfsites/aura endpoint and, where guest user...
- Disclosed
What happened
- Salesforce confirmed a campaign in which attackers mass-scanned public Experience Cloud sites, probed the /s/sfsites/aura endpoint and, where guest user profiles had excessive permissions, queried CRM objects without logging in. ShinyHunters claims data from about 100 high-profile companies (claim); Wikipedia estimates 300 to 400 organizations.
- Root cause: customer misconfiguration of guest user permissions; Salesforce says no platform vulnerability. Attackers used a modified version of Mandiant’s open-source AuraInspector audit tool (adopted January 2026, per ShinyHunters).
- ShinyHunters claimed it.
- Salesforce published hardening guidance.
Sources
- https://www.salesforce.com/blog/protecting-your-data-essential-actions-to-secure-experience-cloud-guest-user-access/
- https://helpnetsecurity.com/2026/03/11/shinyhunters-salesforce-aura-data-breach/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.