JA EN
shiichan

Cloudflare WAF now blocks fresh Mesop, Cisco, and FortiClient exploits!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! Today I've got a security update to share -- it's about the WAF that keeps your sites safe.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published a WAF Release dated April 15, 2026. The headline is a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop, a Python-based UI framework (CVE-2026-33057). It also adds protection for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643), and it refreshes the existing React Server DoS coverage.

The story so far

Cloudflare's WAF includes the Cloudflare Managed Ruleset, a set of rules that Cloudflare maintains for you. Whenever a new vulnerability shows up in the wild, Cloudflare adds or updates rules, so you get up-to-date protection without lifting a finger. A WAF Release like this one is that regular ruleset update, announced in the changelog.

What changes

If your site uses the Cloudflare Managed Ruleset, the three new rules now kick in with a Block action. That means attack requests aimed at Mesop, Cisco Secure FMC, or FortiClient EMS get blocked before they reach you. All three are the scary kind where an unauthenticated, remote attacker could run arbitrary code, so an extra shield is reassuring. Cloudflare still reminds admins to apply the official vendor patches -- the WAF buys you time, but patching is the real fix.

Dive Deep

This release makes six changes to the Cloudflare Managed Ruleset:

  • Cisco Secure FMC RCE (CVE-2026-20079): Log to Block (new detection)
  • FortiClient EMS Pre-Auth SQL Injection (CVE-2026-21643): Log to Block (new detection)
  • Mesop RCE via Base64 payload (CVE-2026-33057): Log to Block (new detection)
  • React Server DoS rule: merged into the existing rule
  • XSS / HTML Injection Link Tag detection (beta): added as Disabled
  • XSS / HTML Injection Embed Tag detection (beta): added as Disabled

The important new detections ship as Block right away, while the two XSS rules arrive in beta and Disabled, so you're unlikely to get surprised by false positives.

Wrap-up

  • The 2026-04-15 WAF Release brings six changes to the Cloudflare Managed Ruleset
  • New Block rules cover dangerous Mesop, Cisco Secure FMC, and FortiClient EMS vulnerabilities
  • The React Server DoS rule was merged, and two XSS detections landed in beta as Disabled
  • Managed Ruleset users are protected automatically, but don't forget the official vendor patches

This one quietly helps out the infra and security folks running the Managed Ruleset.

Related posts