# Cloudflare WAF Gets Ahead of New Threats, Including an MCP Server RCE!

Hey there, it's Shiichan! Today's topic is security. Cloudflare's [WAF](https://developers.cloudflare.com/waf/) just leveled up its defenses again, so let me walk you through it.

## What was announced?

Cloudflare's Changelog published a WAF release dated April 7, 2026. It's an update that adds several new detection rules to the WAF managed rules.

This release goes after three main threats:

- A remote code execution (RCE) vulnerability in MCP Server (CVE-2026-23744)
- A SolarWinds authentication bypass (CVE-2025-40552)
- XSS injection via event handlers placed in HTTP cookies

## The story so far

WAF managed rules work by having Cloudflare add new detection rules on a regular cadence whenever it finds fresh vulnerabilities or attack patterns. So you don't have to write signatures yourself; a release simply lands and your coverage grows. It's great that it keeps up with newer threats too, like the MCP Server RCE that's in the news right now.

## What changes

If you have the managed rules enabled, the detections for these threats start working without any extra effort on your part. Requests targeting these serious, CVE-numbered vulnerabilities get caught on the WAF side.

## Dive Deep

The key detail is that each new rule ships with a different default action depending on the threat.

**Shipping as Block:**

- `MCP Server - Remote Code Execution - CVE-2026-23744`
- `SolarWinds - Auth Bypass - CVE-2025-40552`
- `XSS - OnEvents - Cookies`
- `Generic Rules - Command Execution - 5 - URI`

**Shipping as Disabled:**

- The Body / Header variants of `Generic Rules - Command Execution - 5`
- `SQLi - Evasion` for Body / Headers / URI
- The `SQLi - LIKE 3` and `SQLi - UNION - 2` variants

Instead of blocking every new detection right away, the ones with a higher false-positive risk start on the disabled side so they can be observed first. That's a careful rollout, and if you're cautious you can tune the action to fit your environment before enabling them.

## Wrap-up

- Cloudflare's WAF managed rules gained new detection rules dated 2026-04-07
- The main targets are an MCP Server RCE (CVE-2026-23744), a SolarWinds auth bypass (CVE-2025-40552), and cookie-based XSS
- Serious items ship as Block, while ones prone to false positives ship as Disabled, mixing the actions

For operators using the managed rules, it's a welcome update that grows your defenses without lifting a finger. Anyone who's started touching MCP will want to check this one out!