JA EN
shiichan

Cloudflare's WAF Ships 23 Rule Changes, Now Guarding Against the ActiveMQ RCE!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey there, it's me, Shiichan! Today I found news that Cloudflare's WAF just shipped a batch of new managed rules, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published a "WAF Release" dated April 21, 2026. The WAF (Web Application Firewall) Managed Rules got a batch update, with 23 rule changes in this round.

The headliner is a new rule for the Apache ActiveMQ remote code execution vulnerability CVE-2026-34197. It lets an unauthenticated, remote attacker execute arbitrary code via specially crafted network packets, which is pretty scary. There's also new coverage for a Magento 2 unrestricted file upload gap (the second version of that protection).

The story so far

Cloudflare's Managed Rules get updated regularly, every time new attack techniques or vulnerabilities show up. New rules usually don't jump straight to blocking. They often start in "Log" mode to watch traffic first, then get promoted to "Block." That staged rollout keeps your legitimate traffic from getting caught by false positives.

What changes

With this release, a bunch of rules got promoted from Log to Block. For example:

  • The Apache ActiveMQ RCE rule (CVE-2026-34197) moves to Block
  • Several SQL injection rules (Executable Comment, Sleep Function, Probing, and more) move to Block
  • A generic command injection rule moves to Block

If your site uses Managed Rules, the latest protections generally kick in automatically, so your defenses get stronger without you lifting a finger.

Dive Deep

The 23 changes aren't all brand-new rules. They include merged, deprecated, and renamed rules too.

On the XSS / HTML injection side, new rules landed for Embed, IFrame, and Link tags, though some of these stay in Disabled or Log rather than Block for now. So a few rules are still in a watch-and-wait phase.

To see how each rule behaves in your own zone, you can check the Managed Rules settings from the WAF documentation. You can override an individual rule's action (Block / Log / Disabled) if you need to.

Wrap-up

  • Cloudflare's WAF Managed Rules were updated on 2026-04-21, with 23 rule changes total
  • New coverage for the Apache ActiveMQ RCE (CVE-2026-34197) and Magento 2 file upload
  • Many SQLi and command injection rules moved from Log to Block
  • New XSS rules were added too (some still in Log / Disabled for now)

If you have WAF Managed Rules enabled, the latest defenses roll in without any action on your part, which is a nice update. Security operations folks will want to give it a look.

Related posts