CVE-2025-9844: Salesforce CLI Installer Vulnerability Could Lead to SYSTEM-Level Compromise

CVE-2025-9844 concerns Salesforce’s CLI installer (sf-x64.exe), rated high severity with a CVSS score of 8.8, which could allow arbitrary code execution, privilege escalation, and SYSTEM-level access on affected systems. The flaw arises from improper handling of the executable file path during installation; if a malicious file is placed in the local directory, the installer may execute it instead of the legitimate Salesforce CLI binary.

The advisory notes that the issue affects all Salesforce-CLI versions prior to 2.106.6, but that customers who downloaded the software from official Salesforce distribution channels are not affected. An attacker could exploit CVE-2025-9844 by coaxing users to run the vulnerable installer from a directory containing a malicious executable, effectively granting SYSTEM-level privileges on the machine when combined with social engineering.

Salesforce has released version 2.106.6 to address the flaw, and customers are urged to upgrade immediately and to ensure installers come only from the official Salesforce website. According to the advisory, if you downloaded salesforce-cli from an untrusted source, scan your local system for malware or suspicious activity.