JA EN
shiichan

Cloudflare's WAF Now Blocks Two Fresh CVEs!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shii-chan! Today I've got a small but important security update for you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog comes a managed-rules update for the WAF (Web Application Firewall), titled "WAF Release - 2026-05-04." It's a regular weekly release, and this time it adds several new detections to widen the coverage. Here's how the original puts it:

This week's release focuses on new detections to expand coverage across command injection, SQL injection, PHP object injection, remote code execution, and XSS attack vectors.

So all the usual suspects are covered: command injection, SQL injection, PHP object injection, remote code execution (RCE), and XSS.

The story so far

Cloudflare maintains the WAF managed rules for you, so you don't have to write signatures yourself. The trade-off is that every time a new vulnerability shows up, someone has to keep adding detection rules and tidying up old ones. This release is exactly that kind of routine maintenance pass.

What changes

The best part is that attacks targeting brand-new CVEs are set to Block right out of the gate.

  • Fortinet FortiSandbox command injection (CVE-2026-39808) -> action: Block
  • SmarterMail remote code execution (CVE-2026-24423) -> action: Block

Both land with a Block action, so even if you run those products behind Cloudflare, the WAF layer will stop these requests first.

Dive Deep

There are plenty of rule action changes and cleanups too.

  • 3 XSS / HTML Injection Object Tag rules (Body, Headers, URI) were promoted from Log to Block
  • 6 command injection rules were disabled (Generic 9 and Sleep variants merged into existing rules)
  • 2 RCE Bash Bypass rules were disabled
  • 3 PHP object injection rules were disabled
  • 3 SQL injection DROP rules were disabled
  • 2 SQL injection rules (SELECT Expression, String Concatenation) moved from Block to Disabled

A lot of the disabling and merging happens because beta rules were folded into the original rules and renamed for consistency. Adding new detections is only half the job -- cutting duplicates to raise precision matters just as much. Since whether a rule is Log, Block, or Disabled can affect your own zone, anyone with detailed managed-rule overrides may want to double-check their config.

Wrap-up

  • A routine release for Cloudflare's WAF managed rules (2026-05-04)
  • Two new CVE detections: FortiSandbox (CVE-2026-39808) and SmarterMail (CVE-2026-24423), both Block
  • 3 XSS Object Tag rules promoted from Log to Block
  • Command injection, RCE, PHP object injection, and SQL injection rules disabled or merged for cleanup

If you run WAF on Cloudflare and fine-tune the managed rules, this one's for you!

Related posts