# Salesforce: Critical incident: Service Disruption: Core Service

**Summary:** _summary pending_
- Kind: Major incident · Label: outage (model (Jev))
- Changed: 2026-07-09 04:24 UTC · Detected: 2026-10-18 05:09 UTC
- [Source: https://status.salesforce.com/incidents/20004252](https://status.salesforce.com/incidents/20004252)
- [Company: Salesforce](https://rewindex.com/company/salesforce.md)
- Versions: before (none: first archived) → after incident\_version:130/20004252@affddf568d4d
- Change 1 of 1 for this incident

Incident page (full timeline): [Service Disruption: Core Service](https://rewindex.com/company/salesforce/incidents/20004252.md)
## What changed

**1. Added: Title**

```diff
+ Service Disruption: Core Service
```

**2. Added: Impact**

```diff
+ critical
```

**3. Added: Status**

```diff
+ resolved
```

**4. Added: Start time**

```diff
+ 2026-07-09 04:24 UTC
```

**5. Added: Resolved time**

```diff
+ 2026-07-09 09:50 UTC
```

**6. Added: Affected components**

```diff
+ 359 instances, Core Service
```

**7. Added: Update** (update) · 2026-07-09 09:02 UTC

```diff
+ We're aware that some customers are unable to log into their sandbox environments due to unexpected multi-factor authentication (MFA) prompts. We’ve identified that a recent change is enforcing MFA and passkey verification  and we’re preparing a rollback to restore services. We'll provide an update in 30 minutes or sooner if additional information becomes available.
```

**8. Added: Update** (update) · 2026-07-09 09:33 UTC

```diff
+ We've started rolling back the recent change and are monitoring the system to verify that expected login behavior is restored. We’ve also identified a few additional impacted instances, and those have now been included in the Trust post. Customers on those instances will receive notifications going forward.  We're continuing to identify any other impacted instances and we'll provide an update in 30 minutes or sooner if additional information becomes available.
```

**9. Added: Update** (update) · 2026-07-09 10:10 UTC

```diff
+ We've completed the rollback of the recent change, and service has been restored. Customers should now be able to log in to their sandbox environments as expected without unexpected multi-factor authentication (MFA) or passkey enforcement. During the investigation, we identified that the start time is different from initially understood. We've updated the incident start time and the list of impacted instances to accurately reflect the scope of the issue. We sincerely apologize for any inconvenience this may have caused to your business and appreciate your patience while we worked to resolve this.
```

**10. Added: Update** (update) · 2026-07-09 12:07 UTC

```diff
+ Further investigations have confirmed that JPN4S, JPN8S, JPN24S, JPN154S, JPN172S, JPN182S, JPN184S, and KOR4S weren't impacted by this incident. We are removing these instances from the Trust post and apologize for any concern or inconvenience caused. 
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-07-09 04:24 UTC | Critical incident: Service Disruption: Core Service (this change) | outage |

All Salesforce changes: [timeline](https://rewindex.com/company/salesforce/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/ic65ddc397e0008 · Markdown: https://rewindex.com/change/ic65ddc397e0008.md · JSON: https://rewindex.com/api/v1/changes/ic65ddc397e0008 · Generated 2026-10-18T11:25:21.811Z