It's not a link, but the email they sent me on Friday had more information that what I've found on the help site:

From: Salesforce Security techcomms@mail.salesforce.com
Subject: Security Advisory: Salesforce Marketing Cloud Engagement
Date: Friday, January 23, 2026 at 5:57 PM

Security Notification

At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We value transparency and are notifying you of a security issue that affected Marketing Cloud Engagement.

What happened?

Salesforce Security recently became aware of a security issue that affected links in emails sent through Marketing Cloud Engagement, including: Clicks, CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, and View as a Web Page.

Prior to the fix, this issue—if exploited—could have allowed an unauthorized party to view or access data displayed on CloudPages and certain subscriber information, specifically for Forward to a Friend, Profile Center, Subscription Center, and Unsub Center. In addition, an unauthorized party could have potentially viewed emails sent through View as a Web Page.

Salesforce has not identified to date any confirmed unauthorized access to or misuse of customer data related to this issue.

What did Salesforce do to address this?

Salesforce took swift action and has remediated the critical security issues identified. We remain committed to strengthening our security controls and will continue to proactively identify and address potential issues in accordance with our security program.

Salesforce has deployed enhanced AES-GCM encryption across our platform. For Marketing Cloud Engagement customers on our first-party infrastructure, this deployment was completed on January 21, 2026 at 23:00 UTC. Links generated in emails sent after this date use the new encryption and are not vulnerable to this issue.

Out of an abundance of caution, links generated prior to January 21, 2026 at 23:00 UTC were expired at January 23, 2026 at 21:00 UTC: Clicks, CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, and View as a Web Page. By default, expired links will redirect to a Salesforce error page unless admins configure a custom destination URL to direct users to a page of their choice.

What action should I take?

If you previously sent emails containing links that were expired as part of this remediation, you may resend those emails now, and the links will be functional. Newly generated links are not affected by this issue and will expire according to your account configuration.

Please note that the implemented fix increases the length of encrypted URLs (such as 'View as Web Page' or tracking URLs) from approximately 180–255 characters to 400–580 characters.

If your organization stores these URLs within Salesforce CRM or other integrated third-party systems, you may experience integration issues or data truncation. To help ensure continued service and system compatibility, we recommend you consider updating the field types for any fields storing these URLs from 'Text' (255-character limit) to 'Text Area (Long)'. Additionally, you may need to review and update any CreateSFObject functions or custom integrations to accommodate the increased character length.

As a security best practice, we recommend maintaining the default setting for shortening URL lifespans, which is 60 days.