Introduction

Files shared inside Salesforce, such as contracts, invoices, documents, and attachments, are critical to daily business operations. However, these files can also pose security risks if malicious content is uploaded, either intentionally or accidentally.

With the Spring ’26 preview release, Salesforce introduces malware scanning for Salesforce Files (Beta). This feature automatically scans uploaded files and blocks malicious content, helping protect both users and the org from security threats.

This enhancement was delivered directly based on customer feedback from IdeaExchange.

What’s New in Spring ’26?

Salesforce now scans files for viruses and malware across Salesforce Files.

Key capabilities include:

● Blocking malicious files during UI uploads
● Asynchronous scanning of files uploaded through APIs
● Preventing downloads of malicious files
● Tracking detected threats in the Malicious Files (Beta) list
● Improving org-wide file security automatically

Why This Feature Matters

Before Spring ’26:

● Salesforce relied heavily on external security controls
● Malicious files could be uploaded through integrations
● Admins had limited visibility into file-based threats

With malware scanning enabled:

● File security is built directly into Salesforce
● The attack surface is reduced
● Threats are centrally visible to admins
● File collaboration becomes safer

How Malware Scanning Works

File Upload via UI

● A user uploads a file
● Salesforce scans the file immediately
● If malware is detected, the upload is blocked

File Upload via API

● A file is uploaded using an API or integration
● Salesforce scans the file asynchronously
● If malicious, the file is added to the Malicious Files (Beta) list

File Download

● A user attempts to download a file
● If the file is flagged as malicious, the download is blocked

File owners or users with shared access can still view the file, but downloading is restricted.

Where This Feature Applies

This feature applies to:

● Salesforce Files
● Lightning Experience
● Salesforce Classic
● UI-based uploads and API integrations

This ensures protection across both end-user activity and automated processes.

Who Can Access Malicious Files?

Required Permissions

● Manage Malicious Files (Beta)
Allows viewing and downloading all malicious files

● Download Malicious Files (Beta)
Allows downloading malicious files only

File owners or users with shared access can still view malicious files.

How to Enable or Verify Malware Scanning

Setup Steps

● Go to Setup
● In Quick Find, search for Files
● Select Salesforce Files | General Settings
● Verify Scan files for viruses or malware (Beta) is enabled

This setting is enabled by default.

Malicious Files (Beta) List

When malware is detected:

● The file appears in the Malicious Files (Beta) list
● Admins with permission can review detected threats
● Files can be downloaded for investigation
● Corrective actions can be taken

This provides visibility and control for security teams.

Example Use Case

A third-party integration uploads documents through an API:

● One uploaded file contains malware
● Salesforce scans the file asynchronously
● The file is flagged and added to the Malicious Files (Beta) list
● Users are prevented from downloading the file
● An admin reviews and resolves the issue

Result:

● The threat is contained
● No user disruption occurs

Best Practices

● Review the Malicious Files (Beta) list regularly
● Grant malicious file permissions only to security admins
● Monitor API integrations that upload files
● Educate users on safe file handling practices
● Test the feature in sandbox orgs

Limitations and Notes

● Feature is in beta with rolling availability
● Governed by Salesforce Beta Services Terms
● Availability timing may vary by org
● Behavior may change before general availability

Who Benefits the Most?

● Salesforce Administrators
● Security and compliance teams
● Orgs with frequent file uploads
● Enterprises using API-based integrations
● Regulated industries

Conclusion

Malware scanning for Salesforce Files (Beta) in Salesforce Spring ’26 is a significant security enhancement. By blocking malicious uploads, preventing dangerous downloads, and providing centralized visibility into threats, Salesforce helps organizations collaborate more safely.

For security-focused orgs, this preview feature delivers strong protection and is well worth enabling early.

Blogs

Protect Your Salesforce Org and Users by Scanning Files for Malware (Beta)