2025-26 Salesforce breach class map
What compromised real Salesforce orgs in 2025-26: for each, the precondition Vulkro flags and the part no scanner can see.
vulkro-sf scan ./force-app
vulkro-sf org oauth-risk --target-org my-prod
1. OAuth token theft through a vendor's Connected App (2025)
What happened. Refresh tokens for two widely used third-party Connected Apps were stolen from the vendors and replayed against hundreds of customer orgs to export CRM data.
What Vulkro flags. Connected Apps with the Full scope plus a refresh token (Connected Apps). On a live org, org oauth-risk rates every app from its scopes, IP rules and token policy, lists who can approve uninstalled apps, gives a revoke list (recommendations only), and checks LoginHistory and app names against the published indicators of the 2025 campaigns. A match is a reason to investigate, not proof of a breach.
Not visible. The compromise at the vendor.
2. Experience Cloud guest-user exposure (2023-25)
What happened. Automated scans found public sites whose guest profile could read sensitive standard objects, sometimes with View All Records, and pulled the records through the Aura API.
What Vulkro flags. Guest User License profiles with read or View All Records on sensitive objects: Critical for View All, High for read (Profiles and permission sets). On a live org, org guest-live and vulkro-sf exposure show what a guest can reach.
Not visible. Whether a probe already reached your site.
3. Vishing that installs a malicious Connected App (2025)
What happened. Attackers phoned help desks, got a user to authorize a malicious Connected App, then used its token for bulk export.
What Vulkro flags. Broad-scope Connected Apps, dormant and over-privileged admins (live org), and holders of "Use Any API Client" and "Approve Uninstalled Connected Apps" (org oauth-risk).
Not visible. The phone call itself.
4. ForcedLeak (Agentforce, 2025)
What happened. A prompt injected through a Web-to-Lead field drove an agent to call an Apex action that ran without sharing, returning data the visitor should never see.
What Vulkro flags. Agent actions (GenAiFunction) whose Apex class is without sharing, or has no sharing keyword on a reachable class: High (Agentforce).
Not visible. The injected text in a live record. A check of which fields a prompt template grounds on is planned.
Recent incidents came mostly from misconfiguration and stolen vendor tokens, which the 2023 Top-20 predates. A new breach class gets an entry here and a row in the methodology.
See also: Top-20 coverage, Live-org setup