# Cloudflare WAF Blocks a New FortiSandbox Path Traversal Flaw!

Hey everyone, it's me, Shii-chan! Today I found a small security update to share with you.

## What was announced?

Cloudflare's Changelog published its scheduled "WAF Release - 2026-07-01" for the [WAF](https://developers.cloudflare.com/waf/). There are two changes this time: a new detection rule for a path traversal vulnerability in Fortinet FortiSandbox (CVE-2026-39813), and an action change for the rule that spots fake Bing / MSN bots.

## The story so far

Cloudflare's Managed Ruleset gets small updates like this whenever a new vulnerability shows up. That means you don't have to hand-write rules yourself. Cloudflare keeps refreshing the protections for you, and this release is just one of those routine touch-ups.

## What changes

For FortiSandbox's CVE-2026-39813, a new detection rule now kicks in with a Block action. Meanwhile, the "Anomaly:Header:User-Agent - Fake Bing or MSN Bot" rule moves from Enabled to Disabled, so it stops acting. One protection added, one paused.

## Dive Deep

Pulling the key points from the release table:

- Ruleset: Cloudflare Managed Ruleset.
- New rule (ID ending in d84c92c9): Fortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813. Action goes from Log to Block. It's a new detection.
- Changed rule (ID ending in c12cf9c8): Anomaly:Header:User-Agent - Fake Bing or MSN Bot. Enabled to Disabled (the note says the action is changing from BLOCK to Disabled).

Here's how the post describes the CVE:

> A path traversal vulnerability in Fortinet FortiSandbox allows remote, unauthenticated attackers to read arbitrary files from the underlying filesystem due to insufficient validation of user-supplied input paths.

An unauthenticated, remote attacker could read arbitrary files by abusing weak path validation, which is scary, so blocking it early really matters.

## Wrap-up

- A WAF release dated 2026-07-01 landed in the Cloudflare Managed Ruleset.
- A new detection rule now Blocks the FortiSandbox path traversal flaw (CVE-2026-39813).
- The fake Bing / MSN bot rule moves from Enabled to Disabled.
- If you use the Cloudflare Managed Ruleset, your protections update automatically, and folks running FortiSandbox especially should take note.