A missing authorization vulnerability in the Amazon Connect Salesforce Lambda integration – tracked as CVE-2026-94384 – was disclosed publicly on September 22, 2026, and it’s the kind of finding that deserves more attention from CRM and RevOps teams than it’s currently getting. The flaw sits inside sfExecuteAWSService, a component of the AmazonConnectSalesforceLambda application hosted on AWS’s Serverless Application Repository. In plain terms: authorization checks that should be there aren’t, and that gap creates a real exposure window for any organization running Amazon Connect alongside Salesforce.

This isn’t a theoretical edge case. Amazon Connect is widely deployed in contact centers that feed customer interaction data directly into Salesforce sales pipelines. When the integration between those two systems has a missing authorization flaw, the blast radius isn’t just an IT problem – it touches customer records, deal data, and the operational infrastructure that RevOps teams rely on daily.

What the Amazon Connect Salesforce Security Vulnerability Actually Means

The bulletin classifies CVE-2026-94384 as “Important” – AWS’s way of saying this requires immediate attention without yet reaching the critical threshold. The affected component is a serverless application that acts as a bridge, letting Amazon Connect call Salesforce APIs and vice versa. The sfExecuteAWSService function specifically handles execution of AWS services on behalf of Salesforce workflows.

Missing authorization in this context means the function doesn’t adequately verify whether the caller is actually permitted to trigger those AWS service executions. That’s a significant gap. An attacker who can reach the Lambda function – or a misconfigured internal process that shouldn’t have access – could potentially invoke AWS services without the proper permission checks firing.

Bulletin ID: 2026-115-AWS, Publication Date: 09/22/2026 – Amazon Connect Salesforce Lambda (AmazonConnectSalesforceLambda) is a Serverless Application Repository application classified as Important (requires attention) under CVE-2026-94384.

The practical concern for CRM teams isn’t just data exposure. It’s the integrity of automated workflows. If your contact center is routing call outcomes into Salesforce, updating sales forecasts, or triggering follow-up tasks based on Amazon Connect events, a compromised or misbehaving Lambda function can corrupt that data chain quietly – before anyone notices.

Why CRM-Adjacent Infrastructure Vulnerabilities Are Often Underestimated

Most security conversations in CRM circles focus on the CRM platform itself. Salesforce’s own permission model, sharing rules, field-level security – these get reviewed regularly by admins. What gets far less scrutiny is the connective tissue: the Lambda functions, middleware apps, and serverless integrations that sit between Salesforce and the broader cloud stack.

That’s a blind spot worth addressing. The 2026 Nucleus Research Data Integration Technology Value Matrix, also released this week, named Salesforce (via Informatica) among the leaders in the data integration market alongside Boomi, Matillion, Oracle, and Qlik. The recognition reflects how central Salesforce has become as a data hub – not just a CRM. But that centrality cuts both ways. The more integrations feeding into and out of Salesforce, the larger the attack surface becomes.

Serverless architectures like AWS Lambda are particularly tricky here. They’re designed to be ephemeral and low-friction to deploy, which is exactly why teams bolt them onto existing workflows without always applying the same security rigor they’d use for a traditional application. A missing authorization check in a Lambda function doesn’t announce itself. It just sits there, waiting.

For teams thinking about go-to-market infrastructure security, this is a useful reminder that the tools you’re evaluating aren’t just the front-end platforms – they include every integration point in between.

Which Teams Are Most Exposed

Not every Salesforce customer is affected. The vulnerability specifically targets organizations using the AmazonConnectSalesforceLambda app from the AWS Serverless Application Repository. That narrows the scope, but it doesn’t make it niche. Amazon Connect has grown significantly as a contact center platform, particularly among mid-market and enterprise companies that want to keep their infrastructure within AWS while connecting customer interaction data to Salesforce.

The teams most directly exposed are likely:

• Contact center operations teams running Amazon Connect with a Salesforce CRM integration for logging calls, creating cases, or updating contact records
• RevOps and RevOps teams that have built automated workflows triggering AWS services from Salesforce flows or Process Builder
• Sales engineering and solutions teams that deployed the Lambda integration to handle real-time data passing between the two platforms
• IT and security teams responsible for auditing third-party serverless applications in their AWS environments

If your organization falls into any of these categories, check whether you’re running the affected version of AmazonConnectSalesforceLambda and review the AWS security bulletin directly for remediation guidance. Don’t wait on this one.

What This Means for Data Integration Security in CRM Stacks

The timing of this disclosure alongside the Nucleus Research Data Integration Value Matrix is coincidental, but instructive. Data integration is maturing fast. Nucleus Research’s 2026 matrix notes that the market has moved well beyond simple data warehouse connectors – organizations are now managing complex, real-time data flows across cloud platforms, and the tools doing that work have become more sophisticated as a result.

Sophistication brings complexity, and complexity creates surface area for vulnerabilities. The leaders in the Nucleus matrix – Boomi, Matillion, Oracle, Qlik, and Salesforce via Informatica – are building platforms capable of handling enterprise-scale data movement. But the security posture of those integrations depends heavily on how they’re configured and maintained by the teams deploying them.

For RevOps professionals, the takeaway here isn’t to distrust integration platforms. It’s to treat integration security as an ongoing operational concern rather than a one-time setup decision. The CRM tools you choose are only as secure as the integrations connecting them to the rest of your stack.

As we’ve explored before in our coverage of what Salesforce’s Koa model means for CRM AI in 2026, the direction of travel for CRM platforms involves more autonomous, AI-driven workflows. That makes authorization and access control at the integration layer even more consequential – if an AI agent is triggering downstream AWS services through a Lambda function that doesn’t check permissions properly, the problem scales with the automation.

Practical Steps for CRM and RevOps Teams Right Now

The disclosure is recent. Here’s what’s worth doing immediately if you’re managing a Salesforce environment with Amazon Connect in the mix.

• Check your AWS Serverless Application Repository for any deployed instances of AmazonConnectSalesforceLambda and identify the version currently running
• Review the AWS Security Bulletin 2026-115-AWS for specific remediation steps and patch availability
• Audit IAM roles and permissions attached to the Lambda functions in your Connect-Salesforce integration – tighten anything that looks overly permissive
• Look at your CloudWatch logs for the affected Lambda function to check for any unusual invocation patterns before today’s date
• Loop in your security team if they aren’t already aware – this is a vendor-disclosed CVE, which means it may already be in external threat intelligence feeds

Beyond the immediate fix, this is a good moment to schedule a broader review of any serverless functions in your CRM integration layer. The sales cycle data and customer records flowing through these integrations represent some of your most sensitive commercial intelligence, and treating that infrastructure with the same care you’d give your core CRM platform is just good practice.

The Broader Pattern Worth Watching

CVE-2026-94384 is one disclosure. But it fits a pattern that’s been building for a few years: CRM platforms are no longer bounded systems. They’re hubs. Customer data flows in from contact centers, out to marketing automation, through AI enrichment layers, and back again – often via serverless functions, webhooks, and middleware that don’t get the same governance attention as the core platform.

The customer acquisition cost implications of a data breach or workflow corruption event are hard to quantify in advance, but they’re real. Lost trust, disrupted sales data, compliance exposure – none of it is cheap to clean up. Getting ahead of integration security before an incident happens is significantly less expensive than responding after one.

For teams building or refining their go-to-market tech stack, this vulnerability is a timely prompt to think about which parts of your infrastructure are actually inventoried, monitored, and regularly reviewed. Most teams can name their CRM, their MAP, and their data warehouse. Fewer can name every Lambda function touching customer data.

If you want to stay current on developments like this as they emerge, the CRM Daily Newsletter covers security, integration, and platform news specifically for CRM and GTM professionals.

The open question here isn’t whether to patch CVE-2026-94384 – you should, promptly. It’s whether this disclosure will prompt a more systematic look at integration security across the CRM stack, or whether it’ll be treated as an isolated incident and quickly forgotten once the patch is applied. History suggests the latter, and that’s worth sitting with.