Salesforce Deployment Compromise via Gainsight Application

Salesforce reported detecting unusual activity involving the AppExchange Gainsight application, which is installed and managed by Salesforce customers. According to Salesforce, the observed behavior may have allowed unauthorized access to customer data via the app’s connection. No vulnerabilities were reported within Salesforce’s platform itself. Salesforce disabled the OAuth connection for all Gainsight-published applications on November 20, 2025, suspending their ability to interact with Salesforce environments until further notice.

Salesforce emphasized that the revokation of OAuth tokens does not affect historical logs or audit data. Customers retain access to Setup Audit Trails, Event Monitoring logs, and API records to support their investigations. While Salesforce suggests reviewing these logs for potential compromise, it remains unconfirmed whether the root cause lies solely with the Gainsight application or its integration configuration.