Application Security Changelog

Four new managed rules block active exploitation of a critical remote code execution and SQL injection vulnerability in popular web frameworks, applied to both Cloudflare Managed and Free rulesets.

New WAF rules block unauthenticated memory disclosure in Citrix NetScaler ADC (CVE-2026-8451) and pre-authentication remote code execution in Progress Kemp LoadMaster (CVE-2026-8037). Both rules log by default and block on detection.

Added a new rule to block path traversal attacks targeting Fortinet FortiSandbox (CVE‑2026‑39813). The Anomaly:Header:User‑Agent — Fake Bing or MSN Bot rule was disabled (previously set to Block), indicating a high false‑positive rate.

New managed protection addresses a critical pre-authentication OS command injection vulnerability in Ivanti Sentry (CVE-2026-10520). The new detection rule deploys with a Block action.

Announcement Date

Release Date

Release Behavior

Legacy Rule ID

Rule ID

Description

Comments

2026-06-15

2026-06-22

Log

N/A

500a90789f874345b60b0de7242fdf83

Ivanti Sentry - Command Injection - CVE:CVE-2026-10520

This is a new detection.

This week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic.…

You can now match incoming requests against Cloudforce One threat intelligence in your WAF rules. A new detection looks up the client IP address of each request against the threat intelligence database. If the IP was involved in threat activity in the past seven days, Cloudflare…

TL;DR: Brand Protection now features an Automated Cease & Desist (C&D) workflow. When you discover an infringing domain hosted outside of Cloudflare, you can instantly generate, review, and download a custom-branded, pre-filled legal notice in seconds.

This release introduces new detections for a critical SQL injection vulnerability in Drupal installations utilizing PostgreSQL (CVE-2026-9082), alongside targeted protection for an unsafe deserialization flaw in the Mirasvit Cache Warmer extension (CVE-2026-45247). Additionally,…

Cloudforce One users can now turn Threat Events indicators into active defense. With this update, users can instantly generate a WAF rule that matches the dynamic list of IP addresses…

TL;DR: We’ve launched Threat Actor Profiles directly inside the Threat Events dashboard. You can now immediately pivot from a generic alert or blocked event to a profile that unmasks the "Who, Why, and How" behind a threat event.

Security Insights scans now run more often. Cloudflare scans Free accounts every 7 days, Pro and Business accounts every 3 days, and Enterprise accounts daily.

WAF Release - 2026-05-20

This emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's is_args stale-state bug (CVE-2026-42945).

We’ve added a new Agent Readiness tab to URL Scanner reports accessible via the Cloudflare dashboard. This feature evaluates your site against emerging AI standards and provides six specialized scores to help you optimize for the next generation of AI agents and automated…

Key Findings

Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range…