Security Overview

Xactly understands that the confidentiality, integrity, and availability of our customers’ information are vital to their business operations and therefore to our success. We use a multi-layered approach to protect that key information, constantly monitoring and improving our applications, systems, and processes to meet the changing demands and challenges of security.

InfoSec Update

Dear Xactly Customers,

(10/22/26)
Xactly is aware of the recent critical vulnerability disclosure, CVE-2026-91403, which primarily impacts specific Java-based environments. Our security and infrastructure teams are actively assessing our systems to determine any potential exposure and identify required remediation actions. At this time, there is no evidence of any active exploitation or impact on Xactly services, customer data, or systems.

We are treating this investigation with the highest priority. We will update this trust page with additional details and our remediation plan as new information becomes available.

(10/21/26)
Following the recent disclosure of vulnerabilities CVE-2026-109618 and CVE-2026-109619 (collectively known as PHP2Shell), Xactly has taken immediate action.

Xactly investigated and identified a small number of production assets running the exposed versions of PHP. The use case for these assets was very limited. The affected systems host the Analytics Refresh pages for customers. These pages are static and are refreshed every five minutes by a script that gathers the latest data from various production databases to generate the PHP code.

The vulnerability disclosure was shared on October 21. On the same day, Xactly identified the affected assets, took them offline, rebuilt them, and relaunched the service with the vulnerability removed. No indications of compromise were identified.

No customer action is required in relation to this vulnerability.

(12/11/2025)
Xactly has investigated the recently published vulnerabilities regarding React and Next.js, ‘React2Shell’ (CVE‑2025‑55182 and CVE‑2025‑66478). Following an internal audit of our technology stack, we have verified that Xactly services remain unaffected, as our production environment does not rely on the vulnerable components or configurations identified. We remain committed to the highest standards of security and data integrity. If you require further information, please reach out to your Xactly representative.

(12/11/2025)

Xactly is aware of the reported security incident currently impacting Gainsight and Salesforce. We are actively investigating whether this incident has any potential impact on Xactly’s systems or services.
At this time, we have no reason to believe that Xactly was materially impacted by this incident. We are conducting a thorough review as part of our standard security protocols and will provide updates if our assessment changes.

(11/26/2025)

Xactly is aware of the security incident disclosed by F5, involving unauthorized access by a threat actor to F5’s internal BIG-IP product development environment and engineering knowledge platforms.

Following an internal review, Xactly confirms that our internal network, product platform, source code repository, and customer data were NOT compromised as a result of the F5 incident. We do not utilize the specific affected F5 systems (BIG-IP, F5OS development environments) in our infrastructure.

(10/22/2025)

NPM Supply Chain Incident – No Impact to Xactly

Xactly is aware of recent reports regarding compromised NPM packages, including the Shai-Hulud attack disclosed on September 16, 2025. Our security and engineering teams have conducted a review and have confirmed that there is no indication that Xactly products and platforms have been affected by any of the impacted packages. We understand the seriousness of the NPM supply chain vulnerabilities and remain vigilant. Xactly will continue to closely monitor for any new disclosures and evolving threat intelligence related to NPM supply chain attacks, and will provide an update if our assessment changes

(9/18/2025)

Xactly utilizes Drift within our Corporate IT environment; on our corporate website. We are aware of the recent security incident involving Drift and are actively engaged in communications with the Drift team. At this time, Xactly has not been notified of any impact or breach affecting our organization.

We have conducted an internal investigation and found no evidence of any compromise or unauthorized access involving Drift or Salesforce in connection with Xactly. As a proactive precaution, we have updated credentials associated with relevant integrations.

Please be assured that all Xactly customer data remains securely housed within our production environments, which are logically separated from our Corporate IT environment.

We will continue to monitor the situation closely and will promptly update you should any pertinent information arise.

– Xactly Global Customer Support Team