JA EN
shiichan

Cloudflare WAF Blocks a New FortiSandbox Path Traversal Flaw!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shii-chan! Today I found a small security update to share with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published its scheduled "WAF Release - 2026-07-01" for the WAF. There are two changes this time: a new detection rule for a path traversal vulnerability in Fortinet FortiSandbox (CVE-2026-39813), and an action change for the rule that spots fake Bing / MSN bots.

The story so far

Cloudflare's Managed Ruleset gets small updates like this whenever a new vulnerability shows up. That means you don't have to hand-write rules yourself. Cloudflare keeps refreshing the protections for you, and this release is just one of those routine touch-ups.

What changes

For FortiSandbox's CVE-2026-39813, a new detection rule now kicks in with a Block action. Meanwhile, the "Anomaly:Header:User-Agent - Fake Bing or MSN Bot" rule moves from Enabled to Disabled, so it stops acting. One protection added, one paused.

Dive Deep

Pulling the key points from the release table:

  • Ruleset: Cloudflare Managed Ruleset.
  • New rule (ID ending in d84c92c9): Fortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813. Action goes from Log to Block. It's a new detection.
  • Changed rule (ID ending in c12cf9c8): Anomaly:Header:User-Agent - Fake Bing or MSN Bot. Enabled to Disabled (the note says the action is changing from BLOCK to Disabled).

Here's how the post describes the CVE:

A path traversal vulnerability in Fortinet FortiSandbox allows remote, unauthenticated attackers to read arbitrary files from the underlying filesystem due to insufficient validation of user-supplied input paths.

An unauthenticated, remote attacker could read arbitrary files by abusing weak path validation, which is scary, so blocking it early really matters.

Wrap-up

  • A WAF release dated 2026-07-01 landed in the Cloudflare Managed Ruleset.
  • A new detection rule now Blocks the FortiSandbox path traversal flaw (CVE-2026-39813).
  • The fake Bing / MSN bot rule moves from Enabled to Disabled.
  • If you use the Cloudflare Managed Ruleset, your protections update automatically, and folks running FortiSandbox especially should take note.

Related posts