Salesforce CLI Installer Flaw Lets Attackers Run Code and Gain SYSTEM-Level Access

A serious security flaw in the Salesforce CLI installer (sf-x64.exe) has been assigned CVE-2025-9844, allowing attackers to execute arbitrary code with SYSTEM-level privileges on Windows machines. The issue arises from improper handling of file paths during installation, which can be exploited via simple social engineering. If a user is tricked into downloading a compromised installer or places a rogue executable in the same folder, the installer may run the attacker’s file instead of Salesforce’s legitimate code.

Affected Salesforce CLI versions are prior to 2.106.6, and Salesforce addressed the flaw in version 2.106.6; users should verify they are running this version or later by using sf –version. The article notes that installers obtained directly from Salesforce’s official site remain safe, as those files are properly signed and validated against tampering. according to Salesforce, organisations can prevent exploitation of CVE-2025-9844 by ensuring proper download hygiene and updating to the fixed version.