Salesforce and Drift Breach Exposes OAuth Token Vulnerabilities

On September 11, 2025, a major security breach was reported involving Salesforce and its integration with Drift, where attackers exploited vulnerabilities to steal OAuth tokens. This incident granted unauthorized access to sensitive data within Salesforce, affecting numerous enterprises reliant on these platforms. The breach underscores the security risks associated with integration points in cloud services, highlighting the need for robust security measures in API management and token handling. As organizations increasingly adopt cloud solutions, they must recognize the potential vulnerabilities introduced through third-party integrations and take proactive steps to mitigate risks. Immediate actions include reviewing OAuth configurations, enhancing token security protocols, and implementing multi-factor authentication to reduce unauthorized access risks. For detailed insights, refer to the full report here.

Also In Security Today

Active Exploitation of Vulnerabilities: Critical vulnerabilities are under active exploitation, notably a zero-day in Cisco Secure Firewall (CVE-2025-20333), enabling remote code execution. Organizations must prioritize patching to prevent potential breaches. Read more here.
Broad Industry Impact: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported an increase in cyber incidents affecting various sectors, urging organizations to strengthen their security measures. Full details are available here.
Emergency Alerts by FBI: The FBI has issued warnings regarding ongoing campaigns targeting Salesforce users, possibly linked to prior breaches. This highlights the importance of staying vigilant against evolving cyber threats. More information can be found here.

Analyst's Take

Today's breach involving Salesforce and Drift emphasizes the growing risks associated with interconnected systems and third-party integrations. As organizations shift to cloud-based services, defenders must prioritize security audits of their integration points and ensure that OAuth tokens are managed securely. The active exploitation of critical vulnerabilities like CVE-2025-20333 serves as a stark reminder of the need for timely patch management and continuous monitoring. Security teams should adopt a proactive approach, enhancing incident response capabilities and implementing comprehensive security policies to safeguard against evolving threats.