CVE-2025-26496: 
Tableau Server vulnerability analysis and mitigation

CVE-2025-26496 is a Type Confusion (CWE-843) vulnerability in Salesforce Tableau Server and Tableau Desktop on Windows and Linux, specifically within the File Upload modules, that allows Local Code Inclusion. It affects Tableau Server and Tableau Desktop versions before 2025.1.3, before 2024.2.12, and before 2023.3.19. The vulnerability was published on August 22, 2025, and patches were made available the same day. It carries a CVSS v3.1 base score of 9.3 (Critical) per NVD, and 9.6 (Critical) per ENISA's EUVD scoring (Salesforce Advisory, Red Hat CVE).

The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type / 'Type Confusion'), occurring in the File Upload modules of Tableau Server and Tableau Desktop on Windows and Linux. A type confusion flaw allows an attacker to supply a resource of an unexpected type during file upload processing, which the application then handles incorrectly, enabling Local Code Inclusion — the loading and execution of attacker-controlled code within the application's context. Exploitation requires local access but no privileges and no user interaction, and the scope is changed, meaning the impact can extend beyond the vulnerable component itself (Salesforce Advisory, ZeroPath Summary).

Successful exploitation results in high impacts to confidentiality, integrity, and availability, as an attacker can achieve arbitrary local code execution within the Tableau Server or Desktop environment. The changed scope indicates that a successful attack can affect resources beyond the vulnerable component, potentially enabling lateral movement within the host or broader enterprise environment. Sensitive data processed or stored by Tableau — including business intelligence data, credentials, and connection strings — could be exposed or tampered with (Salesforce Advisory, SecurityOnline).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (ZeroPath Summary). The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was detected by Qualys (detection ID 384647) and is being tracked across multiple threat intelligence platforms (Feedly).

Salesforce has released patched versions of Tableau Server and Tableau Desktop to address this vulnerability. Organizations should upgrade to one of the following fixed versions as soon as possible:

• Tableau Server / Desktop 2025.1.3 or later
• Tableau Server / Desktop 2024.2.12 or later
• Tableau Server / Desktop 2023.3.19 or later

As interim measures, restrict local access to Tableau installations, implement strict file upload validation controls, apply the principle of least privilege to Tableau service accounts, and monitor system logs for suspicious local activity (Salesforce Advisory).

The vulnerability received notable coverage across cybersecurity news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and CyberPress, with headlines highlighting the risk of malicious file uploads and code execution in enterprise Tableau deployments (GBHackers, SecurityOnline). The vulnerability was featured in The Hacker News' weekly recap alongside other notable disclosures, and was highlighted by Black Kite as a priority for third-party risk management teams (The Hacker News, Black Kite). Social media discussion was observed on Mastodon and Bluesky, and the CVE appeared in Reddit's trending CVE lists for the week of August 26–30, 2025.