Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds

WAF

Apr 27, 2026

WAF Release - 2026-04-27

WAF

This week's release focuses on new improvements to enhance coverage.

Key Findings

Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

Continuous Rule Improvements

We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	PostgreSQL - SQLi - COPY - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "PostgreSQL - SQLi - COPY - Body (ID: ). The rule previously known as "PostgreSQL - SQLi - COPY" is now renamed to "PostgreSQL - SQLi - COPY - Body".
Cloudflare Managed Ruleset	N/A	PostgreSQL - SQLi - COPY - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	PostgreSQL - SQLi - COPY - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR MAKE_SET/ELT - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - AND/OR MAKE_SET/ELT - Body" (ID: ). The rule previously known as "SQLi - AND/OR MAKE_SET/ELT" is now renamed to "SQLi - AND/OR MAKE_SET/ELT - Body".
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR MAKE_SET/ELT - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR MAKE_SET/ELT - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Common Patterns - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Common Patterns - Body" (ID: ). The rule previously known as "SQLi - Common Patterns" is now renamed to "SQLi - Common Patterns - Body".
Cloudflare Managed Ruleset	N/A	SQLi - Common Patterns - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Common Patterns - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Equation - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Equation - Body" (ID: ). The rule previously known as "SQLi - Equation" is now renamed to "SQLi - Equation - Body".
Cloudflare Managed Ruleset	N/A	SQLi - Equation - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Equation - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR Digit Operator Digit - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - AND/OR Digit Operator Digit - Body" (ID: ). The rule previously known as "SQLi - AND/OR Digit Operator Digit" is now renamed to "SQLi - AND/OR Digit Operator Digit - Body".
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR Digit Operator Digit - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR Digit Operator Digit - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Benchmark Function - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Benchmark Function - Body" (ID: ). The rule previously known as "SQLi - Benchmark Function" is now renamed to "SQLi - Benchmark Function - Body".
Cloudflare Managed Ruleset	N/A	SQLi - Benchmark Function - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Benchmark Function - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Comparison - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Comparison - Body" (ID: ). The rule previously known as "SQLi - Comparison" is now renamed to "SQLi - Comparison - Body".
Cloudflare Managed Ruleset	N/A	SQLi - Comparison - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Comparison - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - String Concatenation - Body - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - String Concatenation - Headers" (ID: ).The rule previously known as "SQLi - String Concatenation - Headers" is now renamed to "SQLi - String Concatenation - Body".
Cloudflare Managed Ruleset	N/A	SQLi - String Concatenation - Headers	Log	Block	This is a new detection.(Former Id was )
Cloudflare Managed Ruleset	N/A	SQLi - String Concatenation - URI	Log	Block	This is a new detection. (Former Id was )
Cloudflare Managed Ruleset	N/A	SQLi - SELECT Expression - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - SELECT Expression - Body" (ID: ). The rule previously known as "SQLi - SELECT Expression" is now renamed to "SQLi - SELECT Expression - Body".
Cloudflare Managed Ruleset	N/A	SQLi - SELECT Expression - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - SELECT Expression - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - ORD and ASCII - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - ORD and ASCII- Body" (ID: ). The rule previously known as "SQLi - ORD and ASCII" is now renamed to "SQLi - ORD and ASCII- Body".
Cloudflare Managed Ruleset	N/A	SQLi - ORD and ASCII - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - ORD and ASCII - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Destructive Operations	Log	Block	This is a new detection.

Apr 27, 2026

WAF Release - Scheduled changes for 2026-05-04

WAF

Announcement Date	Release Date	Release Behavior	Legacy Rule ID	Description	Comments
2026-04-27	2026-05-04	Disabled	N/A	Command Injection - Generic 9 - Body Vector - Beta	This is a new detection. This rule will be merged into the original rule "Command Injection - Generic 9 - Body Vector" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	Command Injection - Generic 9 - Header Vector - Beta	This is a new detection. This rule will be merged into the original rule "Command Injection - Generic 9 - Header Vector" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	Command Injection - Generic 9 - URI Vector - Beta	This is a new detection. This rule will be merged into the original rule "Command Injection - Generic 9 - URI Vector" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	Command Injection - Sleep - Beta	This is a new detection. This rule will be merged into the original rule "Command Injection - Sleep" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	Command Injection - Sleep - Headers	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	Command Injection - Sleep - URI	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	Fortinet FortiSandbox - Command Injection - CVE:CVE-2026-39808	This is a new detection.
2026-04-27	2026-05-04	Log	N/A	SmarterMail - Remote Code Execution - CVE:CVE-2026-24423	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	SQLi - DROP - 2 - URI	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	SQLi - DROP - 2 - Headers	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	SQLi - DROP - 2 - Beta	This is a new detection. This rule will be merged into the original rule "SQLi - DROP - 2" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	PHP Object Injection - 2 - URI	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	PHP Object Injection - 2 - Headers	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	PHP Object Injection - 2 - Body - Beta	This is a new detection. This rule will be merged into the original rule "PHP Object Injection - 2" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	Remote Code Execution - Common Bash Bypass - Body - Beta	This is a new detection. This rule will be merged into the original rule "Remote Code Execution - Common Bash Bypass" (ID: )
2026-04-27	2026-05-04	Disabled	N/A	Remote Code Execution - Common Bash Bypass - URI	This is a new detection.
2026-04-27	2026-05-04	Disabled	N/A	Remote Code Execution - Common Bash Bypass - Headers	This is a new detection.
2026-04-21	2026-05-04	Log	N/A	XSS, HTML Injection - Object Tag - Body (beta)	This is a new detection.
2026-04-21	2026-05-04	Log	N/A	XSS, HTML Injection - Object Tag - Headers (beta)	This is a new detection.
2026-04-21	2026-05-04	Log	N/A	XSS, HTML Injection - Object Tag - URI (beta)	This is a new detection.

Apr 21, 2026

WAF Release - 2026-04-21

WAF

This week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers.

Key Findings

Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise.
Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce.

Impact

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities.

Continuous Rule Improvements

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Command Injection - Generic 8 - uri	Log	Block	This is a new detection. Previous description was "Command Injection - Generic 8 - uri - Beta"
Cloudflare Managed Ruleset	N/A	Command Injection - Generic 8 - body - Beta	Disabled	Disabled	This is a new detection. This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: ). The rule previously known as "Command Injection - Generic 8" is now renamed to "Command Injection - Generic 8 - body".
Cloudflare Managed Ruleset	N/A	MySQL - SQLi - Executable Comment - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "MySQL - SQLi - Executable Comment - Body" (ID: ) The rule previously known as "MySQL - SQLi - Executable Comment" is now renamed to "MySQL - SQLi - Executable Comment - Body".
Cloudflare Managed Ruleset	N/A	MySQL - SQLi - Executable Comment - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	MySQL - SQLi - Executable Comment - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Magento 2 - Unrestricted file upload - 2	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Sleep Function - Beta	Log	Block	This is a new detection. This rule is merged into the original rule "SQLi - Sleep Function" (ID: )
Cloudflare Managed Ruleset	N/A	SQLi - Sleep Function - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Sleep Function - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Probing - uri	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Probing - header	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Probing - body	Disabled	Disabled	This is a new detection. This rule is merged into the original rule "SQLi - Probing" (ID: )
Cloudflare Managed Ruleset	N/A	SQLi - Probing 2	Disabled	Disabled	This rule had duplicate detection logic and has been deprecated.
Cloudflare Managed Ruleset	N/A	SQLi - UNION in MSSQL - Body	Disabled	Disabled	This rule has been renamed to differentiate from "SQLi - UNION in MSSQL" (ID: ) and contains updated rule logic.
Cloudflare Managed Ruleset	N/A	SQLi - UNION - 3	Disabled	Disabled	This rule had duplicate detection logic and has been deprecated.
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - Embed Tag - URI	Disabled	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - Embed Tag - Headers	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - Link Tag - Headers	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - Link Tag - URI	Disabled	Disabled	This is a new detection.

Apr 15, 2026

WAF Release - 2026-04-15

WAF

This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).

Key Findings

Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.
FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.
Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.

Impact

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta	Log	Block	This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: )
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - Link Tag - URI (beta)	N/A	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	XSS, HTML Injection - Embed Tag - URI (beta)	N/A	Disabled	This is a new detection.

Apr 14, 2026

Email obfuscation decode script is now non-render-blocking
WAF
The decode script injected by Email Address Obfuscation now loads with the defer attribute. This means the script no longer blocks page rendering. It downloads in parallel with HTML parsing and executes after the document is fully parsed, before the DOMContentLoaded event.

This improves page loading performance, contributing to better Core Web Vitals, for all zones with Email Address Obfuscation on. No action is required.

If you have custom JavaScript that depends on email addresses being decoded at a specific point during page load, note that the decode script now executes after HTML parsing completes rather than inline during parsing.

Apr 07, 2026

WAF Release - 2026-04-07

WAF

This week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging "OnEvent" handlers within HTTP cookies.

Key Findings

MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution.
SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation.
XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values.

Impact

Successful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Generic Rules - Command Execution - 5 - Body	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic Rules - Command Execution - 5 - Header	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic Rules - Command Execution - 5 - URI	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	MCP Server - Remote Code Execution - CVE:CVE-2026-23744	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	XSS - OnEvents - Cookies	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Evasion - Body	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Evasion - Headers	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Evasion - URI	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - LIKE 3 - Body	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - LIKE 3 - URI	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - UNION - 2 - Body	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - UNION - 2 - URI	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SolarWinds - Auth Bypass - CVE:CVE-2025-40552	Log	Block	This is a new detection.

Mar 30, 2026

WAF Release - 2026-03-30

WAF

This week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts. Additionally, this release includes targeted protection for a high-impact unrestricted file upload vulnerability in Magento and Adobe Commerce.

Key Findings

CVE-2025-59718: An improper cryptographic signature verification vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication using a maliciously crafted SAML message, if that feature is enabled on the device.
Magento 2 - Unrestricted File Upload: A critical flaw in Magento and Adobe Commerce allows unauthenticated attackers to bypass security checks and upload malicious files to the server, potentially leading to Remote Code Execution (RCE).

Impact

Successful exploitation of the Fortinet and Magento vulnerabilities could allow unauthenticated attackers to gain administrative control or deploy webshells, leading to complete server compromise and data theft.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Generic Rules - Parameter Pollution - Body	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic Rules - Parameter Pollution - Header - Form	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic Rules - Parameter Pollution - URI	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Magento 2 - Unrestricted file upload	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718	Log	Block	This is a new detection.

Mar 23, 2026

WAF Release - 2026-03-23

WAF

This week's release focuses on new improvements to enhance coverage.

Key Findings

Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Command Injection - Generic 9 - URI Vector	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Command Injection - Generic 9 - Header Vector	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Command Injection - Generic 9 - Body Vector	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132 (beta)	Log	Block	This rule has been merged into the original rule "PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132" (ID: )

Mar 12, 2026

WAF Release - 2026-03-12 - Emergency

WAF

This week's release introduces new detections for vulnerabilities in Ivanti Endpoint Manager Mobile (CVE-2026-1281 and CVE-2026-1340), alongside a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts within the Content-Security-Policy (CSP) HTTP request header.

Key Findings

CVE-2026-1281 & CVE-2026-1340: Ivanti Endpoint Manager Mobile processes HTTP requests through Apache RevwriteMap directives that pass user-controlled input to Bash scripts (/mi/bin/map-appstore-url and /mi/bin/map-aft-store-url). Bash scripts do not sanitize user input and are vulnerable to shell arithmetic expansion thereby allowing attackers to achieve unauthenticated remote code execution.
Generic XSS in CSP Header: This rule identifies malicious payloads embedded within the request's Content-Security-Policy header. It specifically targets scenarios where web frameworks or applications trust and extract values directly from the CSP header in the incoming request without sufficient validation. Attackers can provide crafted header values to inject scripts or malicious directives that are subsequently processed by the server.

Impact

Successful exploitation of Ivanti EPMM vulnerability allows unauthenticated remote code execution and generic XSS in CSP header allows attackers to inject malicious scripts during page rendering. In environments using server-side caching, this poisoned XSS content can subsequently be cached and automatically served to all visitors.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Ivanti EPMM - Code Injection - CVE:CVE-2026-1281 CVE:CVE-2026-1340	Log	Block	This is a new detection.
Cloudflare Managed Ruleset		N/A	Anomaly:Header:Content-Security-Policy	N/A	Block	This is a new detection.

Mar 02, 2026

WAF Release - 2026-03-02

WAF

This week's release introduces new detections for vulnerabilities in SmarterTools SmarterMail (CVE-2025-52691 and CVE-2026-23760), alongside improvements to an existing Command Injection (nslookup) detection to enhance coverage.

Key Findings

CVE-2025-52691: SmarterTools SmarterMail mail server is vulnerable to Arbitrary File Upload, allowing an unauthenticated attacker to upload files to any location on the mail server, potentially enabling remote code execution.
CVE-2026-23760: SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API permitting unaunthenticated to reset system administrator accounts failing to verify existing password or reset token.

Impact

Successful exploitation of these SmarterMail vulnerabilities could lead to full system compromise or unauthorized administrative access to mail servers. Administrators are strongly encouraged to apply vendor patches without delay.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	SmarterMail - Arbitrary File Upload - CVE-2025-52691	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	SmarterMail - Authentication Bypass - CVE-2026-23760	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Command Injection - Nslookup - Beta	Log	Block	This rule is merged into the original rule "Command Injection - Nslookup" (ID: )

Feb 16, 2026

WAF Release - 2026-02-16

WAF

This week’s release introduces new detections for CVE-2025-68645 and CVE-2025-31125.

Key Findings

CVE-2025-68645: A Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 allows unauthenticated remote attackers to craft requests to the /h/rest endpoint, improperly influence internal dispatching, and include arbitrary files from the WebRoot directory.
CVE-2025-31125: Vite, the JavaScript frontend tooling framework, exposes content of non-allowed files via ?inline&import when its development server is network-exposed, enabling unauthorized attackers to read arbitrary files and potentially leak sensitive information.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Zimbra - Local File Inclusion - CVE:CVE-2025-68645	Log	Block	This is a new detection.
Cloudflare Managed Ruleset		N/A	Vite - WASM Import Path Traversal - CVE:CVE-2025-31125	Log	Block	This is a new detection.

Feb 10, 2026

WAF Release - 2026-02-10

WAF

This week’s release changes the rule action from BLOCK to Disabled for Anomaly:Header:User-Agent - Fake Google Bot.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Anomaly:Header:User-Agent - Fake Google Bot	Enabled	Disabled	We are changing the action for this rule from BLOCK to Disabled

Feb 02, 2026

WAF Release - 2026-02-02

WAF

This week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.

Key Findings

CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the Q() class.
CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	XWiki - Remote Code Execution - CVE:CVE-2025-24893 2	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Django SQLI - CVE:CVE-2025-64459	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	NoSQL, MongoDB - SQLi - Comparison - 2	Block	Block	Rule metadata description refined. Detection unchanged.

Jan 26, 2026

WAF Release - 2026-01-26

WAF

This week’s release introduces new detections for denial-of-service attempts targeting React CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗).

Key Findings

CVE-2026-23864 (https://www.cve.org/CVERecord?id=CVE-2026-23864 ↗) affects react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages.
Attackers can send crafted HTTP requests to Server Function endpoints, causing server crashes, out-of-memory exceptions, or excessive CPU usage.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	React Server - DOS - CVE:CVE-2026-23864 - 1	N/A	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	React Server - DOS - CVE:CVE-2026-23864 - 2	N/A	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	React Server - DOS - CVE:CVE-2026-23864 - 3	N/A	Block	This is a new detection.

Jan 20, 2026

WAF Release - 2026-01-20

WAF

This week's release focuses on improvements to existing detections to enhance coverage.

Key Findings

Existing rule enhancements have been deployed to improve detection resilience against SQL injection.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	SQLi - Comment - Beta	Log	Block	This rule is merged into the original rule "SQLi - Comment" (ID: )
Cloudflare Managed Ruleset		N/A	SQLi - Comparison - Beta	Log	Block	This rule is merged into the original rule "SQLi - Comparison" (ID: )

Jan 15, 2026

WAF Release - 2026-01-15

WAF

This week's release focuses on improvements to existing detections to enhance coverage.

Key Findings

Existing rule enhancements have been deployed to improve detection resilience against SQL Injection.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	SQLi - String Function - Beta	Log	Block	This rule is merged into the original rule "SQLi - String Function" (ID: )
Cloudflare Managed Ruleset		N/A	SQLi - Sub Query - Beta	Log	Block	This rule is merged into the original rule "SQLi - Sub Query" (ID: )

Jan 12, 2026

WAF Release - 2026-01-12

WAF

This week's release focuses on improvements to existing detections to enhance coverage.

Key Findings

Existing rule enhancements have been deployed to improve detection resilience against SQL Injection.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	SQLi - AND/OR MAKE_SET/ELT - Beta	Log	Block	This rule is merged into the original rule "SQLi - AND/OR MAKE_SET/ELT" (ID: )
Cloudflare Managed Ruleset		N/A	SQLi - Benchmark Function - Beta	Log	Block	This rule is merged into the original rule "SQLi - Benchmark Function" (ID: )

Dec 18, 2025

WAF Release - 2025-12-18

WAF

This week's release focuses on improvements to existing detections to enhance coverage.

Key Findings

Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Atlassian Confluence - Code Injection - CVE:CVE-2021-26084 - Beta	Log	Block	This rule is merged into the original rule "Atlassian Confluence - Code Injection - CVE:CVE-2021-26084" (ID: )
Cloudflare Managed Ruleset	N/A	PostgreSQL - SQLi - Copy - Beta	Log	Block	This rule is merged into the original rule "PostgreSQL - SQLi - COPY" (ID: )
Cloudflare Managed Ruleset	N/A	Generic Rules - Command Execution - Body	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic Rules - Command Execution - Header	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic Rules - Command Execution - URI	Log	Disabled	This is a new detection.
Cloudflare Managed Ruleset	N/A	SQLi - Tautology - URI - Beta	Log	Block	This rule is merged into the original rule "SQLi - Tautology - URI" (ID: )
Cloudflare Managed Ruleset	N/A	SQLi - WaitFor Function - Beta	Log	Block	This rule is merged into the original rule "SQLi - WaitFor Function" (ID: )
Cloudflare Managed Ruleset	N/A	SQLi - AND/OR Digit Operator Digit 2 - Beta	Log	Block	This rule is merged into the original rule "SQLi - AND/OR Digit Operator Digit" (ID: )
Cloudflare Managed Ruleset	N/A	SQLi - Equation 2 - Beta	Log	Block	This rule is merged into the original rule "SQLi - Equation" (ID: )

Dec 11, 2025

WAF Release - 2025-12-11 - Emergency

WAF

This emergency release introduces rules for CVE-2025-55183 and CVE-2025-55184, targeting server-side function exposure and resource-exhaustion patterns, respectively.

Key Findings

Added coverage for Leaking Server Functions (CVE-2025-55183) and React Function DoS detection (CVE-2025-55184).

Impact

These updates strengthen protection for server-function abuse techniques (CVE-2025-55183, CVE-2025-55184) that may expose internal logic or disrupt application availability.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	React - Leaking Server Functions - CVE:CVE-2025-55183	N/A	Block	This was labeled as Generic - Server Function Source Code Exposure.
Cloudflare Free Ruleset	N/A	React - Leaking Server Functions - CVE:CVE-2025-55183	N/A	Block	This was labeled as Generic - Server Function Source Code Exposure.
Cloudflare Managed Ruleset	N/A	React - DoS - CVE:CVE-2025-55184	N/A	Disabled	This was labeled as Generic – Server Function Resource Exhaustion.

Dec 10, 2025

WAF Release - 2025-12-10 - Emergency

WAF

This additional week's emergency release introduces improvements to our existing rule for React – Remote Code Execution – CVE-2025-55182 - 2, along with two new generic detections covering server-side function exposure and resource-exhaustion patterns.

Key Findings

Enhanced detection logic for React – RCE – CVE-2025-55182, added Generic – Server Function Source Code Exposure, and added Generic – Server Function Resource Exhaustion.

Impact

These updates strengthen protection against React RCE exploitation attempts and broaden coverage for common server-function abuse techniques that may expose internal logic or disrupt application availability.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	React - Remote Code Execution - CVE:CVE-2025-55182 - 2	N/A	Block	This is an improved detection.
Cloudflare Free Ruleset	N/A	React - Remote Code Execution - CVE:CVE-2025-55182 - 2	N/A	Block	This is an improved detection.
Cloudflare Managed Ruleset	N/A	Generic - Server Function Source Code Exposure	N/A	Block	This is a new detection.
Cloudflare Free Ruleset	N/A	Generic - Server Function Source Code Exposure	N/A	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	Generic - Server Function Resource Exhaustion	N/A	Disabled	This is a new detection.

Dec 05, 2025

Increased WAF payload limit for all plans
WAF
Cloudflare WAF now inspects request-payload size of up to 1 MB across all plans to enhance our detection capabilities for React RCE (CVE-2025-55182).

Key Findings

React payloads commonly have a default maximum size of 1 MB. Cloudflare WAF previously inspected up to 128 KB on Enterprise plans, with even lower limits on other plans.

Update: We later reinstated the maximum request-payload size the Cloudflare WAF inspects. Refer to Updating the WAF maximum payload values for details.

Dec 05, 2025

Updating the WAF maximum payload values
WAF
We are reinstating the maximum request-payload size the Cloudflare WAF inspects, with WAF on Enterprise zones inspecting up to 128 KB.

Key Findings

On December 5, 2025, we initially attempted to increase the maximum WAF payload limit to 1 MB across all plans. However, an automatic rollout for all customers proved impractical because the increase led to a surge in false positives for existing managed rules.

This issue was particularly notable within the Cloudflare Managed Ruleset and the Cloudflare OWASP Core Ruleset, impacting customer traffic.

Impact

Customers on paid plans can increase the limit to 1 MB for any of their zones by contacting Cloudflare Support. Free zones are already protected up to 1 MB and do not require any action.

Dec 03, 2025

WAF Release - 2025-12-03 - Emergency

WAF

The WAF rule deployed yesterday to block unsafe deserialization-based RCE has been updated. The rule description now reads “React – RCE – CVE-2025-55182”, explicitly mapping to the recently disclosed React Server Components vulnerability. Detection logic remains unchanged.

Key Findings

Rule description updated to reference React – RCE – CVE-2025-55182 while retaining existing unsafe-deserialization detection.

Impact

Improved classification and traceability with no change to coverage against remote code execution attempts.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	React - RCE - CVE:CVE-2025-55182	N/A	Block	Rule metadata description changed. Detection unchanged.
Cloudflare Free Ruleset		N/A	React - RCE - CVE:CVE-2025-55182	N/A	Block	Rule metadata description changed. Detection unchanged.

Dec 02, 2025

WAF Release - 2025-12-02 - Emergency

WAF

This week's emergency release introduces a new rule to block a critical RCE vulnerability in widely-used web frameworks through unsafe deserialization patterns.

Key Findings

New WAF rule deployed for RCE Generic Framework to block malicious POST requests containing unsafe deserialization patterns. If successfully exploited, this vulnerability allows attackers with network access via HTTP to execute arbitrary code remotely.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code remotely through crafted serialization payloads, enabling complete system compromise, data exfiltration, and potential lateral movement within affected environments.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	RCE Generic - Framework	N/A	Block	This is a new detection.
Cloudflare Free Ruleset		N/A	RCE Generic - Framework	N/A	Block	This is a new detection.

Dec 01, 2025

WAF Release - 2025-12-01

WAF

This week’s release introduces new detections for remote code execution attempts targeting Monsta FTP (CVE-2025-34299), alongside improvements to an existing XSS detection to enhance coverage.

Key Findings

CVE-2025-34299 is a critical remote code execution flaw in Monsta FTP, arising from improper handling of user-supplied parameters within the file-handling interface. Certain builds allow crafted requests to bypass sanitization and reach backend PHP functions that execute arbitrary commands. Attackers can send manipulated parameters through the web panel to trigger command execution within the application’s runtime environment.

Impact

If exploited, the vulnerability enables full remote command execution on the underlying server, allowing takeover of the hosting environment, unauthorized file access, and potential lateral movement. As the flaw can be triggered without authentication on exposed Monsta FTP instances, it represents a severe risk for publicly reachable deployments.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Monsta FTP - Remote Code Execution - CVE:CVE-2025-34299	Log	Block	This is a new detection
Cloudflare Managed Ruleset		N/A	XSS - JS Context Escape - Beta	Log	Block	This rule is merged into the original rule "XSS - JS Context Escape" (ID: )

Search all changelog entries