# Salesforce: Service Disruption: Core Service

- Impact (vendor’s label): critical
- Status: resolved
- Started: 2026-07-09 04:24 UTC · Resolved: 2026-07-09 09:50 UTC · Duration: 5.4 h
- Updates: 4 · Affected components: Core Service, 359 instances
- [Vendor status page: https://status.salesforce.com/incidents/20004252](https://status.salesforce.com/incidents/20004252)
- [Company: Salesforce](https://rewindex.com/company/salesforce.md)

## Timeline of updates

- **update** 2026-07-09 09:02 UTC: We're aware that some customers are unable to log into their sandbox environments due to unexpected multi-factor authentication (MFA) prompts. We’ve identified that a recent change is enforcing MFA and passkey verification  and we’re preparing a rollback to restore services. We'll provide an update in 30 minutes or sooner if additional information becomes available.
- **update** 2026-07-09 09:33 UTC: We've started rolling back the recent change and are monitoring the system to verify that expected login behavior is restored. We’ve also identified a few additional impacted instances, and those have now been included in the Trust post. Customers on those instances will receive notifications going forward.  We're continuing to identify any other impacted instances and we'll provide an update in 30 minutes or sooner if additional information becomes available.
- **update** 2026-07-09 10:10 UTC: We've completed the rollback of the recent change, and service has been restored. Customers should now be able to log in to their sandbox environments as expected without unexpected multi-factor authentication (MFA) or passkey enforcement. During the investigation, we identified that the start time is different from initially understood. We've updated the incident start time and the list of impacted instances to accurately reflect the scope of the issue. We sincerely apologize for any inconvenience this may have caused to your business and appreciate your patience while we worked to resolve this.
- **update** 2026-07-09 12:07 UTC: Further investigations have confirmed that JPN4S, JPN8S, JPN24S, JPN154S, JPN172S, JPN182S, JPN184S, and KOR4S weren't impacted by this incident. We are removing these instances from the Trust post and apologize for any concern or inconvenience caused.

## Rewindex changes for this incident

- 2026-07-09 04:24 UTC: [Critical incident: Service Disruption: Core Service](https://rewindex.com/change/ic65ddc397e0008.md)


---
Canonical: https://rewindex.com/company/salesforce/incidents/20004252 · Markdown: https://rewindex.com/company/salesforce/incidents/20004252.md · JSON: https://rewindex.com/api/v1/companies/salesforce/incidents/20004252 · Generated 2026-10-18T10:28:55.527Z