JA EN
shiichan

Cloudflare WAF now blocks the Ivanti Sentry command injection!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shiichan! Today Cloudflare's WAF shipped a small but important security update, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted "WAF Release - 2026-06-23." This release adds one new managed protection to WAF, targeting a critical vulnerability in Ivanti Sentry: CVE-2026-10520.

It's a pre-authentication OS command injection, which is a really dangerous class of bug. Here's how the post describes it:

An OS command injection vulnerability in Ivanti Sentry allows remote, unauthenticated attackers to execute arbitrary system commands with root privileges.

In other words, a remote attacker with no authentication can run any command with root privileges. The root cause is improper sanitization of input strings parsed during internal configuration handling.

The story so far

Until now there was no dedicated rule for CVE-2026-10520. So the Cloudflare Managed Ruleset couldn't catch this specific attack pattern by name.

What changes

The new detection rule ships enabled with a Block action right away. That's the key part! It's not only Log (record and move on) — the New Action is Block, so it stops the request immediately. If you rely on Cloudflare's managed rules, you're generally protected without lifting a finger. Nice.

Dive Deep

Here's the rule at a glance:

  • Ruleset: Cloudflare Managed Ruleset
  • Rule ID: ...242fdf83
  • Description: Ivanti Sentry - Command Injection - CVE:CVE-2026-10520
  • Previous Action: Log
  • New Action: Block
  • Note: new detection

Just as the comment column says, "This is a new detection." — it's a brand-new rule, not a tweak to an existing one. It's a compact, one-rule release, but pre-auth root command execution is genuinely scary, so this quick coverage is very welcome.

Wrap-up

  • Cloudflare's Changelog published "WAF Release - 2026-06-23"
  • Adds a new rule covering the Ivanti Sentry OS command injection (CVE-2026-10520)
  • Ships in the Cloudflare Managed Ruleset as a new detection, enabled with Block
  • Defends against a dangerous flaw that lets attackers run commands as root without authentication

This one's for folks running Ivanti Sentry, and for the infra and security teams hardening things with Cloudflare's WAF managed rules!

Related posts