WAF - WAF Release - 2026-04-21
This week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers.
Key Findings
-
Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise.
-
Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce.
Impact
Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities.
Continuous Rule Improvements
We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.
Ruleset
Rule ID
Legacy Rule ID
Description
Previous Action
New Action
Comments
Cloudflare Managed Ruleset
ff8df24181aa4573a81be531ee159e2e
N/A
Command Injection - Generic 8 - uri
Log
Block
This is a new detection. Previous description was "Command Injection - Generic 8 - uri - Beta"
Cloudflare Managed Ruleset
9429b63c137247faadeb8a29a15308cf
N/A
Command Injection - Generic 8 - body - Beta
Disabled
Disabled
This is a new detection. This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: 5b3ce84c099040c6a25cee2d413592e2 ). The rule previously known as "Command Injection - Generic 8" is now renamed to "Command Injection - Generic 8 - body".
Cloudflare Managed Ruleset
85aaf5db9e0c4237b87e837e958047ed
N/A
MySQL - SQLi - Executable Comment - Beta
Log
Block
This is a new detection. This rule is merged into the original rule "MySQL - SQLi - Executable Comment - Body" (ID: 8629bb58defe4193ab4d493c7bd2d8fa ) The rule previously known as "MySQL - SQLi - Executable Comment" is now renamed to "MySQL - SQLi - Executable Comment - Body".
Cloudflare Managed Ruleset
d19cd574c4644952881a6f3a582cc559
N/A
MySQL - SQLi - Executable Comment - Headers
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
407f9ec8a17348dfba3b9450a16639d3
N/A
MySQL - SQLi - Executable Comment - URI
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
d07e6dbf15664b99b37b0d2544f24211
N/A
Magento 2 - Unrestricted file upload - 2
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
26ef21cb197b44fc8a98b7cebf170a17
N/A
Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
7f7bc3d28a8e43bf97bd15d68c2ac1a7
N/A
SQLi - Sleep Function - Beta
Log
Block
This is a new detection. This rule is merged into the original rule "SQLi - Sleep Function" (ID: 2c333735f7b24566b17cb64ef77e8d54 )
Cloudflare Managed Ruleset
3872e5638bdf4bf0943a80394dacaeb8
N/A
SQLi - Sleep Function - Headers
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
bebce8fadfa94ccab09eb74fed4c9ece
N/A
SQLi - Sleep Function - URI
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
7a40eed5a8654a50a2598a821dfa64df
N/A
SQLi - Probing - uri
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
15c6b2ce033949b2a1a9f9454c62e2e7
N/A
SQLi - Probing - header
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
fc9d800b7a724181af8d5650aab28ea1
N/A
SQLi - Probing - body
Disabled
Disabled
This is a new detection. This rule is merged into the original rule "SQLi - Probing" (ID: 2c20b5e8684043f48620ff77b4026c88 )
Cloudflare Managed Ruleset
945c5aa9f45141dd872d7ec920999be0
N/A
SQLi - Probing 2
Disabled
Disabled
This rule had duplicate detection logic and has been deprecated.
Cloudflare Managed Ruleset
f1771273700342758e73cf16d7aa0008
N/A
SQLi - UNION in MSSQL - Body
Disabled
Disabled
This rule has been renamed to differentiate from "SQLi - UNION in MSSQL" (ID: ef7db598c7654c729d9db56fee5e35fd ) and contains updated rule logic.
Cloudflare Managed Ruleset
3ffd242b4ba242ca965022d3a67d8561
N/A
SQLi - UNION - 3
Disabled
Disabled
This rule had duplicate detection logic and has been deprecated.
Cloudflare Managed Ruleset
5e69d599ad634c81abe36a5f0af34bba
N/A
XSS, HTML Injection - Embed Tag - URI
Disabled
Disabled
This is a new detection.
Cloudflare Managed Ruleset
2635275641bf44d4bad6a2e170282f38
N/A
XSS, HTML Injection - Embed Tag - Headers
Log
Block
This is a new detection.
Cloudflare Managed Ruleset
b3d033ea9f364574b0a2ec4223f4d718
N/A
XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers
Log
Disabled
This is a new detection.
Cloudflare Managed Ruleset
76c37816ef5c4997ab2080a36978def1
N/A
XSS, HTML Injection - Link Tag - Headers
Log
Disabled
This is a new detection.
Cloudflare Managed Ruleset
7d6757e8a28f4853a72b4ce6ebd81645
N/A
XSS, HTML Injection - Link Tag - URI
Disabled
Disabled
This is a new detection.
Fetched June 19, 2026
