JA EN
shiichan

Cloudflare WAF blocks three fresh CVEs at the edge!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi everyone, it's me, Shii-chan! Today it's all about security. This is a WAF update that stops attacks at the water's edge, so if you run a website you won't want to miss it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published the 2026-06-09 update to the WAF managed ruleset. The highlights are new detection rules for three CVEs, plus a generic rule that targets clever SQL injection (SQLi) bypass attempts.

Here are the three vulnerabilities in scope:

  • CVE-2026-9082: A SQL injection in Drupal sites running on a PostgreSQL backend. Remote, unauthenticated attackers can read or tamper with database contents.
  • CVE-2026-45247: A PHP Object Injection in the Mirasvit Cache Warmer extension for Magento / Adobe Commerce. Unsafe deserialization of untrusted input lets attackers run arbitrary code on the server.
  • CVE-2026-40175: A prototype pollution flaw in the Axios HTTP client library. Attackers can inject malicious properties into the JavaScript prototype, causing crashes (DoS) or, depending on the app, code execution.

The story so far

WAF managed rules keep getting new rules for emerging threats like this. Every time a new CVE lands, Cloudflare ships the signatures, so you don't have to write the rules yourself — dangerous requests are stopped at the edge.

What changes

With these rules in place, payloads that exploit the vulnerabilities above get blocked at the edge before they ever reach your server. Apps running Drupal with PostgreSQL, Magento's Mirasvit extension, or Axios benefit the most. Here's how the changelog frames the impact:

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate database contents, or induce application crashes, leading to severe operational disruption or complete server compromise.

In short: unauthenticated arbitrary code execution, database tampering, or crashes.

Dive Deep

Every added rule is a new detection in the Cloudflare Managed Ruleset, with these default actions:

  • Axios prototype pollution (CVE-2026-40175): Log to Block
  • Drupal PostgreSQL SQLi (CVE-2026-9082, Body and URI, two rules): Log to Block
  • Mirasvit Cache Warmer PHP Object Injection (CVE-2026-45247): new, set to Block
  • SQLi Obfuscated Boolean (Body and Headers, two rules): new, but default Disabled

The interesting bit is that the generic "Obfuscated Boolean" SQLi rule ships Disabled by default. Generic rules can have false positives, so the stance is to ship them off and let you enable them when you need them. The per-CVE rules are firmly set to Block, so those have you covered.

Wrap-up

  • Cloudflare's WAF added new rules for three CVEs (Drupal with PostgreSQL, Mirasvit, Axios) plus generic SQLi bypass detection
  • Per-CVE rules default to Block, while the generic Obfuscated Boolean rule defaults to Disabled
  • Because these are managed rules, sites running the affected products are protected automatically

This one lands especially well for anyone running a website on Drupal, Magento, or Axios!

Related posts