Changelog

2025-11-21

WAF Release - 2025-11-21

This week’s release introduces a critical detection for CVE-2025-61757, a vulnerability in the Oracle Identity Manager REST WebServices component.

Key Findings

This flaw allows unauthenticated attackers with network access over HTTP to fully compromise the Identity Manager, potentially leading to a complete takeover.

Impact

Oracle Identity Manager (CVE-2025-61757): Exploitation could allow an unauthenticated remote attacker to bypass security checks by sending specially crafted requests to the application's message processor. This enables the creation of arbitrary employee accounts, which can be leveraged to modify system configurations and achieve full system compromise.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Oracle Identity Manager - Pre-Auth RCE - CVE:CVE-2025-61757	N/A	Block	This is a new detection.

2025-11-17

WAF Release - 2025-11-17

This week highlights enhancements to detection signatures improving coverage for vulnerabilities in DELMIA Apriso, linked to CVE-2025-6205.

Key Findings

This vulnerability allows unauthenticated attackers to gain privileged access to the application. The latest update provides enhanced detection logic for resilient protection against exploitation attempts.

Impact

DELMIA Apriso (CVE-2025-6205): Exploitation could allow an unauthenticated remote attacker to bypass security checks by sending specially crafted requests to the application's message processor. This enables the creation of arbitrary employee accounts, which can be leveraged to modify system configurations and achieve full system compromise.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	DELMIA Apriso - Auth Bypass - CVE:CVE-2025-6205	Log	Block	This is a new detection.
Cloudflare Managed Ruleset	N/A	PHP Wrapper Injection - Body	N/A	Disabled	Rule metadata description refined. Detection unchanged.
Cloudflare Managed Ruleset	N/A	PHP Wrapper Injection - URI	N/A	Disabled	Rule metadata description refined. Detection unchanged.

2025-11-10

WAF Release - 2025-11-10

This week’s release introduces new detections for Prototype Pollution across three common vectors: URI, Body, and Header/Form.

Key Findings

These attacks can affect both API and web applications by altering normal behavior or bypassing security controls.

Impact

Exploitation may allow attackers to change internal logic or cause unexpected behavior in applications using JavaScript or Node.js frameworks. Developers should sanitize input keys and avoid merging untrusted data structures.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Generic Rules - Prototype Pollution - URI	Log	Disabled	This is a new detection
Cloudflare Managed Ruleset	N/A	Generic Rules - Prototype Pollution - Body	Log	Disabled	This is a new detection
Cloudflare Managed Ruleset	N/A	Generic Rules - Prototype Pollution - Header - Form	Log	Disabled	This is a new detection

2025-11-05

WAF Release - 2025-11-05 - Emergency

This week’s emergency release introduces a new detection signature that enhances coverage for a critical vulnerability in the React Native Metro Development Server, tracked as CVE-2025-11953.

Key Findings

The Metro Development Server exposes an HTTP endpoint that is vulnerable to OS command injection (CWE-78). An unauthenticated network attacker can send a crafted request to this endpoint and execute arbitrary commands on the host running Metro. The vulnerability affects Metro/cli-server-api builds used by React Native Community CLI in pre-patch development releases.

Impact

Successful exploitation of CVE-2025-11953 may result in remote command execution on developer workstations or CI/build agents, leading to credential and secret exposure, source tampering, and potential lateral movement into internal networks. Administrators and developers are strongly advised to apply the vendor's patches and restrict Metro’s network exposure to reduce this risk.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	React Native Metro - Command Injection - CVE:CVE-2025-11953	N/A	Block	This is a New Detection

2025-11-03

WAF Release - 2025-11-03

This week highlights enhancements to detection signatures improving coverage for vulnerabilities in Adobe Commerce and Magento Open Source, linked to CVE-2025-54236.

Key Findings

This vulnerability allows unauthenticated attackers to take over customer accounts through the Commerce REST API and, in certain configurations, may lead to remote code execution. The latest update provides enhanced detection logic for resilient protection against exploitation attempts.

Impact

Adobe Commerce (CVE-2025-54236): Exploitation may allow attackers to hijack sessions, execute arbitrary commands, steal data, and disrupt storefronts, resulting in confidentiality and integrity risks for merchants. Administrators are strongly encouraged to apply vendor patches without delay.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100774C	Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236	Log	Block	This is an improved detection.

2025-10-30

WAF Release - 2025-10-30 - Emergency

This week’s release introduces a new detection signature that enhances coverage for a critical vulnerability in Oracle E-Business Suite, tracked as CVE-2025-61884.

Key Findings

The flaw is easily exploitable and allows an unauthenticated attacker with network access to compromise Oracle Configurator, which can grant access to sensitive resources and configuration data. The affected versions include 12.2.3 through 12.2.14.

Impact

Successful exploitation of CVE-2025-61884 may result in unauthorized access to critical business data or full exposure of information accessible through Oracle Configurator. Administrators are strongly advised to apply vendor's patches and recommended mitigations to reduce this exposure.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Oracle E-Business Suite - SSRF - CVE:CVE-2025-61884	N/A	Block	This is a New Detection

2025-10-24

WAF Release - 2025-10-24 - Emergency

This week’s release introduces a new detection signature that enhances coverage for a critical vulnerability in Windows Server Update Services (WSUS), tracked as CVE-2025-59287.

Key Findings

The vulnerability allows unauthenticated attackers to potentially achieve remote code execution. The updated detection logic strengthens defenses by improving resilience against exploitation attempts targeting this flaw.

Impact

Successful exploitation of CVE-2025-59287 could enable attackers to hijack sessions, execute arbitrary commands, exfiltrate sensitive data, and disrupt storefront operations. These actions pose significant confidentiality and integrity risks to affected environments. Administrators should apply vendor patches immediately to mitigate exposure.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Windows Server - Deserialization - CVE:CVE-2025-59287	N/A	Block	This is a New Detection

2025-10-23

WAF Release - 2025-10-23 - Emergency

This week highlights enhancements to detection signatures improving coverage for vulnerabilities in Adobe Commerce and Magento Open Source, linked to CVE-2025-54236.

Key Findings

This vulnerability allows unauthenticated attackers to take over customer accounts through the Commerce REST API and, in certain configurations, may lead to remote code execution. The latest update enhances detection logic to provide more resilient protection against exploitation attempts.

Impact

Adobe Commerce (CVE-2025-54236): Exploitation may allow attackers to hijack sessions, execute arbitrary commands, steal data, and disrupt storefronts, resulting in confidentiality and integrity risks for merchants. Administrators are strongly encouraged to apply vendor patches without delay.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		N/A	Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236	N/A	Block	This is a New Detection

2025-10-20

WAF Release - 2025-10-20

This week’s update introduces an enhanced rule that expands detection coverage for a critical vulnerability in Oracle E-Business Suite. It also improves an existing rule to provide more reliable coverage in request processing.

Key Findings

New WAF rule deployed for Oracle E-Business Suite (CVE-2025-61882) to block unauthenticated attacker's network access via HTTP to compromise Oracle Concurrent Processing. If successfully exploited, this vulnerability may result in remote code execution.

Impact

Successful exploitation of CVE-2025-61882 allows unauthenticated attackers to execute arbitrary code remotely by chaining multiple weaknesses, enabling lateral movement into internal services, data exfiltration, and large-scale extortionware deployment within Oracle E-Business Suite environments.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100598A	Remote Code Execution - Common Bash Bypass - Beta	Log	Block	This rule is merged into the original rule "Remote Code Execution - Common Bash Bypass" (ID: )
Cloudflare Managed Ruleset	100916A	Oracle E-Business Suite - Remote Code Execution - CVE:CVE-2025-61882 - 2	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	N/A	HTTP Truncated	N/A	Disabled	This is a New Detection

2025-10-17

New detections released for WAF managed rulesets

This week we introduced several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications.

Key Findings

New detections added for multiple exploit categories:

SSRF (Server-Side Request Forgery) — new rules targeting both local and cloud metadata abuse patterns (Beta).

SQL Injection (SQLi) — rules for common patterns, sleep/time-based injections, and string/wait function exploitation across headers and URIs.

SSTI (Server-Side Template Injection) — arithmetic-based probe detections introduced across URI, header, and body fields.

Reverse Shell and XXE payloads — enhanced heuristics for command execution and XML external entity misuse.

Prototype Pollution — new Beta rule identifying common JSON payload structures used in object prototype poisoning.

PHP Wrapper Injection and HTTP Parameter Pollution detections — to catch path traversal and multi-parameter manipulation attempts.

Anomaly Header Checks — detecting CRLF injection attempts in header names.

Impact

These updates help detect multi-vector payloads that blend SSRF + RCE or SQLi + SSTI attacks, especially in cloud-hosted applications with exposed metadata endpoints or unsafe template rendering.

Prototype Pollution and HTTP parameter pollution rules address emerging JavaScript supply-chain exploitation patterns increasingly seen in real-world incidents.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	N/A	Anomaly:Header - name - CR, LF	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - Reverse Shell - Body	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - Reverse Shell - Header	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - Reverse Shell - URI	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - XXE - Body	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - SQLi - Common Patterns - Header URI	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - SQLi - Sleep Function - Header URI	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - SQLi - String Function - Header URI	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Generic Rules - SQLi - WaitFor Function - Header URI	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSRF - Local - Beta	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSRF - Local - 2 - Beta	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSRF - Cloud - Beta	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSRF - Cloud - 2 - Beta	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSTI - Arithmetic Probe - URI	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSTI - Arithmetic Probe - Header	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	SSTI - Arithmetic Probe - Body	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	PHP Wrapper Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	PHP Wrapper Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	HTTP parameter pollution	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	N/A	Prototype Pollution - Common Payloads - Beta	N/A	Disabled	This is a New Detection

2025-10-13

WAF Release - 2025-10-13

This week’s highlights include a new JinJava rule targeting a sandbox-bypass flaw that could allow malicious template input to escape execution controls. The rule improves detection for unsafe template rendering paths.

Key Findings

New WAF rule deployed for JinJava (CVE-2025-59340) to block a sandbox bypass in the template engine that permits attacker-controlled type construction and arbitrary class instantiation; in vulnerable environments this can escalate to remote code execution and full server compromise.

Impact

CVE-2025-59340 — Exploitation enables attacker-supplied type descriptors / Jackson ObjectMapper abuse, allowing arbitrary class loading, file/URL access (LFI/SSRF primitives) and, with suitable gadget chains, potential remote code execution and system compromise.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100892	JinJava - SSTI - CVE:CVE-2025-59340	Log	Block	This is a New Detection

2025-10-07

WAF Release - 2025-10-07 - Emergency

This week highlights multiple critical Cisco vulnerabilities (CVE-2025-20363, CVE-2025-20333, CVE-2025-20362). This flaw stems from improper input validation in HTTP(S) requests. An authenticated VPN user could send crafted requests to execute code as root, potentially compromising the device. The initial two rules were made available on September 28, with a third rule added today, October 7, for more robust protection.

Cisco (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363): Multiple vulnerabilities that could allow attackers to exploit unsafe deserialization and input validation flaws. Successful exploitation may result in arbitrary code execution, privilege escalation, or command injection on affected systems.

Impact

Cisco (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363): Exploitation enables attackers to escalate privileges or achieve remote code execution via command injection. Administrators are strongly advised to apply vendor updates immediately.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100788B	Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363	N/A	Block	This is a New Detection

2025-10-06

WAF Release - 2025-10-06

This week’s highlights prioritise an emergency Oracle E-Business Suite RCE rule deployed to block active, high-impact exploitation. Also addressed are high-severity Chaos Mesh controller command-injection flaws that enable unauthenticated in-cluster RCE and potential cluster compromise, plus a form-data multipart boundary issue that permits HTTP Parameter Pollution (HPP). Two new generic SQLi detections were added to catch inline-comment obfuscation and information disclosure techniques.

Key Findings

New emergency rule released for Oracle E-Business Suite (CVE-2025-61882) addressing an actively exploited remote code execution vulnerability in core business application modules. Immediate mitigation deployed to protect enterprise workloads.
Chaos Mesh (CVE-2025-59358,CVE-2025-59359,CVE-2025-59360,CVE-2025-59361): A GraphQL debug endpoint on the Chaos Controller Manager is exposed without authentication; several controller mutations (cleanTcs, killProcesses, cleanIptables) are vulnerable to OS command injection.
Form-Data (CVE-2025-7783): Attackers who can observe Math.random() outputs and control request fields in form-data may exploit this flaw to perform HTTP parameter pollution, leading to request tampering or data manipulation.
Two new generic SQLi detections added to enhance baseline coverage against inline-comment obfuscation and information disclosure attempts.

Impact

CVE-2025-61882 — Oracle E-Business Suite remote code execution (emergency detection): attacker-controlled input can yield full system compromise, data exfiltration, and operational outage; immediate blocking enforced.
CVE-2025-59358 / CVE-2025-59359 / CVE-2025-59360 / CVE-2025-59361 — Unauthenticated command-injection in Chaos Mesh controllers allowing remote code execution, cluster compromise, and service disruption (high availability risk).
CVE-2025-7783 — Predictable multipart boundaries in form-data enabling HTTP Parameter Pollution; results include request tampering, parameter overwrite, and downstream data integrity loss.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100882	Chaos Mesh - Missing Authentication - CVE:CVE-2025-59358	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100883	Chaos Mesh - Command Injection - CVE:CVE-2025-59359	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100884	Chaos Mesh - Command Injection - CVE:CVE-2025-59361	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100886	Form-Data - Parameter Pollution - CVE:CVE-2025-7783	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100888	Chaos Mesh - Command Injection - CVE:CVE-2025-59360	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100916	Oracle E-Business Suite - Remote Code Execution - CVE:CVE-2025-61882	N/A	Block	This is a New Detection
Cloudflare Managed Ruleset	100917	Generic Rules - SQLi - Inline Comment Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100918	Generic Rules - SQLi - Information Disclosure	N/A	Disabled	This is a New Detection

2025-10-03

WAF Release - 2025-10-03

Managed Ruleset Updated

This update introduces 21 new detections in the Cloudflare Managed Ruleset (all currently set to Disabled mode to preserve remediation logic and allow quick activation if needed). The rules cover a broad spectrum of threats - SQL injection techniques, command and code injection, information disclosure of common files, URL anomalies, and cross-site scripting.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100902	Generic Rules - Command Execution - 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100908	Generic Rules - Command Execution - 3	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100910	Generic Rules - Command Execution - 4	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100915	Generic Rules - Command Execution - 5	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100899	Generic Rules - Content-Type Abuse	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100914	Generic Rules - Content-Type Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100911	Generic Rules - Cookie Header Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100905	Generic Rules - NoSQL Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100913	Generic Rules - NoSQL Injection - 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100907	Generic Rules - Parameter Pollution	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100906	Generic Rules - PHP Object Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100904	Generic Rules - Prototype Pollution	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100897	Generic Rules - Prototype Pollution 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100903	Generic Rules - Reverse Shell	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100909	Generic Rules - Reverse Shell - 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100898	Generic Rules - SSJI NoSQL	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100896	Generic Rules - SSRF	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100895	Generic Rules - Template Injection	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100895A	Generic Rules - Template Injection - 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100912	Generic Rules - XXE	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100900	Relative Paths - Anomaly Headers	N/A	Disabled	This is a New Detection

2025-09-29

WAF Release - 2025-09-29

This week highlights four important vendor- and component-specific issues: an authentication bypass in SimpleHelp (CVE-2024-57727), an information-disclosure flaw in Flowise Cloud (CVE-2025-58434), an SSRF in the WordPress plugin Ditty (CVE-2025-8085), and a directory-traversal bug in Vite (CVE-2025-30208). These are paired with improvements to our generic detection coverage (SQLi, SSRF) to raise the baseline and reduce noisy gaps.

Key Findings

SimpleHelp (CVE-2024-57727): Authentication bypass in SimpleHelp that can allow unauthorized access to management interfaces or sessions.
Flowise Cloud (CVE-2025-58434): Information-disclosure vulnerability in Flowise Cloud that may expose sensitive configuration or user data to unauthenticated or low-privileged actors.
WordPress:Plugin: Ditty (CVE-2025-8085): SSRF in the Ditty WordPress plugin enabling server-side requests that could reach internal services or cloud metadata endpoints.
Vite (CVE-2025-30208): Directory-traversal vulnerability in Vite allowing access to filesystem paths outside the intended web root.

Impact

These vulnerabilities allow attackers to gain access, escalate privileges, or execute actions that were previously unavailable:

SimpleHelp (CVE-2024-57727): An authentication bypass that can let unauthenticated attackers access management interfaces or hijack sessions — enabling lateral movement, credential theft, or privilege escalation within affected environments.
Flowise Cloud (CVE-2025-58434): Information-disclosure flaw that can expose sensitive configuration, tokens, or user data; leaked secrets may be chained into account takeover or privileged access to backend services.
WordPress:Plugin: Ditty (CVE-2025-8085): SSRF that enables server-side requests to internal services or cloud metadata endpoints, potentially allowing attackers to retrieve credentials or reach otherwise inaccessible infrastructure, leading to privilege escalation or cloud resource compromise.
Vite (CVE-2025-30208): Directory-traversal vulnerability that can expose filesystem contents outside the web root (configuration files, keys, source code), which attackers can use to escalate privileges or further compromise systems.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100717	SimpleHelp - Auth Bypass - CVE:CVE-2024-57727	Log	Block	This rule is merged to 100717 in legacy WAF and in new WAF
Cloudflare Managed Ruleset	100775	Flowise Cloud - Information Disclosure - CVE:CVE-2025-58434	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100881	WordPress:Plugin:Ditty - SSRF - CVE:CVE-2025-8085	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100887	Vite - Directory Traversal - CVE:CVE-2025-30208	Log	Block	This is a New Detection

2025-09-28

WAF Release - 2025-09-28 - Emergency

Key Findings

Cisco (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363): Multiple vulnerabilities that could allow attackers to exploit unsafe deserialization and input validation flaws. Successful exploitation may result in arbitrary code execution, privilege escalation, or command injection on affected systems.

Impact

Cisco (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363): Exploitation enables attackers to escalate privileges or achieve remote code execution via command injection.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100788	Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset		100788A	Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363	N/A	Disabled	This is a New Detection

2025-09-26

WAF Release - 2025-09-26

Managed Ruleset Updated

This update introduces 11 new detections in the Cloudflare Managed Ruleset (all currently set to Disabled mode to preserve remediation logic and allow quick activation if needed). The rules cover a broad spectrum of threats - SQL injection techniques, command and code injection, information disclosure of common files, URL anomalies, and cross-site scripting.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100859A	SQLi - UNION - 3	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100889	Command Injection - Generic 9	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100890	Information Disclosure - Common Files - 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100891	Anomaly:URL - Relative Paths	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100894	XSS - Inline Function	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100895	XSS - DOM	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100896	SQLi - MSSQL Length Enumeration	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100897	Generic Rules - Code Injection - 3	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100898	SQLi - Evasion	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100899	SQLi - Probing 2	N/A	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100900	SQLi - Probing	N/A	Disabled	This is a New Detection

2025-09-24

WAF Release - 2025-09-24 - Emergency

This week highlights a critical vendor-specific vulnerability: a deserialization flaw in the License Servlet of Fortra’s GoAnywhere MFT. By forging a license response signature, an attacker can trigger deserialization of arbitrary objects, potentially leading to command injection.

Key Findings

GoAnywhere MFT (CVE-2025-10035): Deserialization vulnerability in the License Servlet that allows attackers with a forged license response signature to deserialize arbitrary objects, potentially resulting in command injection.

Impact

GoAnywhere MFT (CVE-2025-10035): Exploitation enables attackers to escalate privileges or achieve remote code execution via command injection.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100787	Fortra GoAnywhere - Auth Bypass - CVE:CVE-2025-10035	N/A	Block	This is a New Detection

2025-09-22

WAF Release - 2025-09-22

This week emphasizes two critical vendor-specific vulnerabilities: a full elevation-of-privilege in Microsoft Azure Networking (CVE-2025-54914) and a server-side template injection (SSTI) leading to remote code execution (RCE) in Skyvern (CVE-2025-49619). These are complemented by enhancements in generic detections (SQLi, SSRF) to improve baseline coverage.

Key Findings

Azure (CVE-2025-54914): Vulnerability in Azure Networking allowing elevation of privileges.
Skyvern (CVE-2025-49619): Skyvern ≤ 0.1.85 has a server-side template injection (SSTI) vulnerability in its Prompt field (workflow blocks) via Jinja2. Authenticated users with low privileges can get remote code execution (blind).
Generic SQLi / SSRF improvements: Expanded rule coverage to detect obfuscated SQL injection patterns and SSRF across host, local, and cloud contexts.

Impact

These vulnerabilities allow attackers to escalate privileges or execute code under conditions where previously they could not:

Azure CVE-2025-54914 enables an attacker from the network with no credentials to gain high-level access within Azure Networking; could lead to full compromise of networking components.
Skyvern CVE-2025-49619 allows authenticated users with minimal privilege to exploit SSTI for remote code execution, undermining isolation of workflow components.
The improvements for SQLi and SSRF reduce risk from common injection and request-based attacks.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100146	SSRF - Host - 2	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100146B	SSRF - Local - 2	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100146C	SSRF - Cloud - 2	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100714	Azure - Auth Bypass - CVE:CVE-2025-54914	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100758	Skyvern - Remote Code Execution - CVE:CVE-2025-49619	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100773	Next.js - SSRF	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100774	Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100800_BETA	SQLi - Obfuscated Boolean - Beta	Log	Block	This rule has been merged into the original rule (ID: )

2025-09-15

WAF Release - 2025-09-15

This week's update

This week's focus highlights newly disclosed vulnerabilities in DevOps tooling, data visualization platforms, and enterprise CMS solutions. These issues include sensitive information disclosure and remote code execution, putting organizations at risk of credential leakage, unauthorized access, and full system compromise.

Key Findings

Argo CD (CVE-2025-55190): Exposure of sensitive information could allow attackers to access credential data stored in configurations, potentially leading to compromise of Kubernetes workloads and secrets.
DataEase (CVE-2025-57773): Insufficient input validation enables JNDI injection and insecure deserialization, resulting in remote code execution (RCE). Successful exploitation grants attackers control over the application server.
Sitecore (CVE-2025-53694): A sensitive information disclosure flaw allows unauthorized access to confidential information stored in Sitecore deployments, raising the risk of data breaches and privilege escalation.

Impact

These vulnerabilities expose organizations to serious risks, including credential theft, unauthorized access, and full system compromise. Argo CD's flaw may expose Kubernetes secrets, DataEase exploitation could give attackers remote execution capabilities, and Sitecore's disclosure issue increases the likelihood of sensitive data leakage and business impact.

Administrators are strongly advised to apply vendor patches immediately, rotate exposed credentials, and review access controls to mitigate these risks.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100646	Argo CD - Information Disclosure - CVE:CVE-2025-55190s	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100874	DataEase - JNDI injection - CVE:CVE-2025-57773	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100880	Sitecore - Information Disclosure - CVE:CVE-2025-53694	Log	Block	This is a New Detection

2025-09-08

WAF Release - 2025-09-08

This week's update

This week’s focus highlights newly disclosed vulnerabilities in web frameworks, enterprise applications, and widely deployed CMS plugins. The vulnerabilities include SSRF, authentication bypass, arbitrary file upload, and remote code execution (RCE), exposing organizations to high-impact risks such as unauthorized access, system compromise, and potential data exposure. In addition, security rule enhancements have been deployed to cover general command injection and server-side injection attacks, further strengthening protections.

Key Findings

Next.js (CVE-2025-57822): Improper handling of redirects in custom middleware can lead to server-side request forgery (SSRF) when user-supplied headers are forwarded. Attackers could exploit this to access internal services or cloud metadata endpoints. The issue has been resolved in versions 14.2.32 and 15.4.7. Developers using custom middleware should upgrade and verify proper redirect handling in next() calls.
ScriptCase (CVE-2025-47227, CVE-2025-47228): In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), two vulnerabilities allow attackers to reset admin accounts and execute system commands, potentially leading to full compromise of affected deployments.
Sar2HTML (CVE-2025-34030): In Sar2HTML version 3.2.2 and earlier, insufficient input sanitization of the plot parameter allows remote, unauthenticated attackers to execute arbitrary system commands. Exploitation could compromise the underlying server and its data.
Zhiyuan OA (CVE-2025-34040): An arbitrary file upload vulnerability exists in the Zhiyuan OA platform. Improper validation in the wpsAssistServlet interface allows unauthenticated attackers to upload crafted files via path traversal, which can be executed on the web server, leading to remote code execution.
WordPress:Plugin:InfiniteWP Client (CVE-2020-8772): A vulnerability in the InfiniteWP Client plugin allows attackers to perform restricted actions and gain administrative control of connected WordPress sites.

Impact

These vulnerabilities could allow attackers to gain unauthorized access, execute malicious code, or take full control of affected systems. The Next.js SSRF flaw may expose internal services or cloud metadata endpoints to attackers. Exploitations of ScriptCase and Sar2HTML could result in remote code execution, administrative takeover, and full server compromise. In Zhiyuan OA, the arbitrary file upload vulnerability allows attackers to execute malicious code on the web server, potentially exposing sensitive data and applications. The authentication bypass in WordPress InfiniteWP Client enables attackers to gain administrative access, risking data exposure and unauthorized control of connected sites.

Administrators are strongly advised to apply vendor patches immediately, remove unsupported software, and review authentication and access controls to mitigate these risks.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100007D	Command Injection - Common Attack Commands Args	Log	Block	This rule has been merged into the original rule "Command Injection - Common Attack Commands" (ID: ) for New WAF customers only.
Cloudflare Managed Ruleset	100617	Next.js - SSRF - CVE:CVE-2025-57822	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100659_BETA	Common Payloads for Server-Side Template Injection - Beta	Log	Block	This rule is merged into the original rule "Common Payloads for Server-Side Template Injection" (ID: )
Cloudflare Managed Ruleset	100824B	CrushFTP - Remote Code Execution - CVE:CVE-2025-54309 - 3	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100848	ScriptCase - Auth Bypass - CVE:CVE-2025-47227	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100849	ScriptCase - Command Injection - CVE:CVE-2025-47228	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100872	WordPress:Plugin:InfiniteWP Client - Missing Authorization - CVE:CVE-2020-8772	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100873	Sar2HTML - Command Injection - CVE:CVE-2025-34030	Log	Block	This is a New Detection
Cloudflare Managed Ruleset	100875	Zhiyuan OA - Remote Code Execution - CVE:CVE-2025-34040	Log	Block	This is a New Detection

2025-09-04

WAF Release - 2025-09-04 - Emergency

This week's update

This week, new critical vulnerabilities were disclosed in Sitecore’s Sitecore Experience Manager (XM), Sitecore Experience Platform (XP), specifically versions 9.0 through 9.3, and 10.0 through 10.4. These flaws are caused by unsafe data deserialization and code reflection, leaving affected systems at high risk of exploitation.

Key Findings

CVE-2025-53690: Remote Code Execution through Insecure Deserialization
CVE-2025-53691: Remote Code Execution through Insecure Deserialization
CVE-2025-53693: HTML Cache Poisoning through Unsafe Reflections

Impact

Exploitation could allow attackers to execute arbitrary code remotely on the affected system and conduct cache poisoning attacks, potentially leading to further compromise. Applying the latest vendor-released solution without delay is strongly recommended.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100878	Sitecore - Remote Code Execution - CVE:CVE-2025-53691	N/A	Block	This is a new detection
Cloudflare Managed Ruleset	100631	Sitecore - Cache Poisoning - CVE:CVE-2025-53693	N/A	Block	This is a new detection
Cloudflare Managed Ruleset	100879	Sitecore - Remote Code Execution - CVE:CVE-2025-53690	N/A	Block	This is a new detection

2025-09-01

WAF Release - 2025-09-01

This week's update

This week, a critical vulnerability was disclosed in Fortinet FortiWeb (versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and versions 7.0.10 and below), linked to improper parameter handling that could allow unauthorized access.

Key Findings

Fortinet FortiWeb (CVE-2025-52970): A vulnerability may allow an unauthenticated remote attacker with access to non-public information to log in as any existing user on the device via a specially crafted request.

Impact

Exploitation could allow an unauthenticated attacker to impersonate any existing user on the device, potentially enabling them to modify system settings or exfiltrate sensitive information, posing a serious security risk. Upgrading to the latest vendor-released version is strongly recommended.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100586	Fortinet FortiWeb - Auth Bypass - CVE:CVE-2025-52970	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset		100136C	XSS - JavaScript - Headers and Body	N/A	N/A	Rule metadata description refined. Detection unchanged.

2025-08-29

WAF Release - 2025-08-29 - Emergency

This week's update

This week, new critical vulnerabilities were disclosed in Next.js’s image optimization functionality, exposing a broad range of production environments to risks of data exposure and cache manipulation.

Key Findings

CVE-2025-55173: Arbitrary file download from the server via image optimization.
CVE-2025-57752: Cache poisoning leading to unauthorized data disclosure.

Impact

Exploitation could expose sensitive files, leak user or backend data, and undermine application trust. Given Next.js’s wide use, immediate patching and cache hardening are strongly advised.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset		100613	Next.js - Dangerous File Download - CVE:CVE-2025-55173	N/A	Block	This is a new detection
Cloudflare Managed Ruleset		100616	Next.js - Information Disclosure - CVE:CVE-2025-57752	N/A	Block	This is a new detection

2025-08-25

WAF Release - 2025-08-25

This week's update

This week, critical vulnerabilities were disclosed that impact widely used open-source infrastructure, creating high-risk scenarios for code execution and operational disruption.

Key Findings

Apache HTTP Server – Code Execution (CVE-2024-38474): A flaw in Apache HTTP Server allows attackers to achieve remote code execution, enabling full compromise of affected servers. This vulnerability threatens the confidentiality, integrity, and availability of critical web services.
Laravel (CVE-2024-55661): A security flaw in Laravel introduces the potential for remote code execution under specific conditions. Exploitation could provide attackers with unauthorized access to application logic and sensitive backend data.

Impact

These vulnerabilities pose severe risks to enterprise environments and open-source ecosystems. Remote code execution enables attackers to gain deep system access, steal data, disrupt services, and establish persistent footholds for broader intrusions. Given the widespread deployment of Apache HTTP Server and Laravel in production systems, timely patching and mitigation are critical.

Ruleset	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	100822_BETA	WordPress:Plugin:WPBookit - Remote Code Execution - CVE:CVE-2025-6058	N/A	Disabled	This was merged in to the original rule "WordPress:Plugin:WPBookit - Remote Code Execution - CVE:CVE-2025-6058" (ID: )
Cloudflare Managed Ruleset	100831	Apache HTTP Server - Code Execution - CVE:CVE-2024-38474	Log	Disabled	This is a New Detection
Cloudflare Managed Ruleset	100846	Laravel - Remote Code Execution - CVE:CVE-2024-55661	Log	Disabled	This is a New Detection