diff --git a/src/content/changelog/waf/2026-07-21-waf-release.mdx b/src/content/changelog/waf/2026-07-21-waf-release.mdx new file mode 100644 index 00000000000..291fa6392ec --- /dev/null +++ b/src/content/changelog/waf/2026-07-21-waf-release.mdx @@ -0,0 +1,272 @@ +--- +title: "WAF Release - 2026-07-21" +description: Cloudflare WAF managed rulesets 2026-07-21 +date: 2026-07-21 +--- + +import { RuleID } from "~/components"; + +This release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Adobe ColdFusion and WordPress, alongside enhanced generic protections against enhanced generic protections against Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and Cross-Site Scripting (XSS) obfuscation techniques. To strengthen overall detection capabilities across emerging threat vectors, new emergency detection rules have also been deployed for Generic Rules - Unauthenticated Remote Code Execution (RCE), Generic Rules - Authentication Bypass (Auth Bypass - 2) and Generic Rules - Information Disclosure. + + +**Key Findings** + +- CVE-2026-48276: A path traversal vulnerability in Adobe ColdFusion file upload mechanisms allows unauthenticated attackers to write or upload files to arbitrary locations outside designated directories on the origin server. + +- CVE-2026-48282: A path traversal vulnerability in Adobe ColdFusion enables unauthenticated attackers to manipulate directory sequences and access restricted system files on the host filesystem. + +- CVE-2026-60137: An unauthenticated SQL injection vulnerability affecting WordPress. Threat actors exploit unsanitized input parameters to execute arbitrary SQL queries, leading to unauthorized database access, record manipulation, or data exfiltration. + + +- CVE-2026-63030: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset + + N/ASSRF - Restricted ProtocolLogBlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/ASSRF - Obfuscated HostLogBlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/ALFI - Path TraversalLogBlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AAdobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276LogBlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AAdobe ColdFusion - Path Traversal - CVE:CVE-2026-48282LogBlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AXSS — JS Bracket Concat Obfuscation - BodyLogDisabled + This is a new detection. +
Cloudflare Managed Ruleset + + N/AXSS — JS Bracket Concat Obfuscation - HeadersLogDisabled + This is a new detection. +
Cloudflare Managed Ruleset + + N/AXSS — JS Bracket Concat Obfuscation - URILogBlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AWordpress - SQL Injection - CVE:CVE-2026-60137N/ABlock + This was labeled as Generic Rules - SQLi. +
Cloudflare Managed Ruleset + + N/AWordpress - Remote Code Execution - CVE:CVE-2026-63030N/ABlock + This was labeled as Generic Rules - Unauthenticated RCE. +
Cloudflare Free Ruleset + + N/AWordpress - SQL Injection - CVE:CVE-2026-60137N/ABlock + This was labeled as Generic Rules - SQLi. +
Cloudflare Free Ruleset + + N/AWordpress - Remote Code Execution - CVE:CVE-2026-63030N/ABlock + This was labeled as Generic Rules - Unauthenticated RCE. +
Cloudflare Managed Ruleset + + N/AGeneric Rules - RCEN/ABlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AGeneric Rules - Information DisclosureN/ABlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AGeneric Rules - Auth Bypass - 2N/ABlock + This is a new detection. +
Cloudflare Managed Ruleset + + N/AGeneric Rules - Command Execution - Body - BetaDisabled - + This detection has been removed. +
Cloudflare Managed Ruleset + + N/AGeneric Rules - Command Execution - Header - BetaDisabled - + This detection has been removed. +
Cloudflare Managed Ruleset + + N/AGeneric Rules - Command Execution - URI - BetaDisabled - + This detection has been removed. +
\ No newline at end of file diff --git a/src/content/changelog/waf/scheduled-waf-release.mdx b/src/content/changelog/waf/scheduled-waf-release.mdx index bc67c921a88..af8fed73979 100644 --- a/src/content/changelog/waf/scheduled-waf-release.mdx +++ b/src/content/changelog/waf/scheduled-waf-release.mdx @@ -1,7 +1,7 @@ --- -title: WAF Release - Scheduled changes for 2026-07-20 -description: WAF managed ruleset changes scheduled for 2026-07-20 -date: 2026-07-14 +title: WAF Release - Scheduled changes for 2026-07-27 +description: WAF managed ruleset changes scheduled for 2026-07-27 +date: 2026-07-21 publish_future_dated_entry: true --- @@ -21,108 +21,43 @@ import { RuleID } from "~/components"; - 2026-07-12 - 2026-07-20 + 2026-07-21 + 2026-07-27 Log N/A - + - SSRF - Restricted Protocol + SSRF - Cloud - Beta - This is a new detection. - - - - 2026-07-12 - 2026-07-20 - Log - N/A - - - - SSRF - Obfuscated Host - - This is a new detection. + This is an improved detection. - 2026-07-12 - 2026-07-20 - Log - N/A - - - - LFI - Path Traversal - - This is a new detection. - - - - 2026-07-14 - 2026-07-20 - Log - N/A - - - - Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276 - - This is a new detection. - - - - 2026-07-14 - 2026-07-20 - Log - N/A - - - - Adobe ColdFusion - Path Traversal - CVE:CVE-2026-48282 - - This is a new detection. - - - - 2026-07-14 - 2026-07-20 - Log - N/A - - - - XSS — JS Bracket Concat Obfuscation - Body - - This is a new detection. - - - - 2026-07-14 - 2026-07-20 + 2026-07-21 + 2026-07-27 Log N/A - + - XSS — JS Bracket Concat Obfuscation - Headers + Command Injection - Obfuscation This is a new detection. - 2026-07-14 - 2026-07-20 + 2026-07-21 + 2026-07-27 Log N/A - + - XSS — JS Bracket Concat Obfuscation - URI + Generic Rules - DoS This is a new detection. - + \ No newline at end of file