JA EN
shiichan

Cloudflare WAF Instantly Blocks Critical Citrix NetScaler and Kemp LoadMaster Flaws!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hi, it's Shiichan! Today there's a critical vulnerability response you won't want to miss, so let me share it with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog published its scheduled "WAF Release - 2026-07-14" for the WAF. This release adds new detection rules for two vulnerabilities affecting critical infrastructure appliances.

  • An unauthenticated memory disclosure flaw in Citrix NetScaler ADC / NetScaler Gateway (CVE-2026-8451)
  • A pre-authentication remote code execution (RCE) flaw in Progress Kemp LoadMaster (CVE-2026-8037)

Both are new rules added to the Cloudflare Managed Ruleset in response to high-severity vulnerabilities.

The story so far

Cloudflare's Managed Ruleset gets new detection rules whenever a new vulnerability shows up like this. That means you don't have to hand-write rules yourself — Cloudflare keeps refreshing the protections for you. This is another one of those routine updates, but since it targets two serious vulnerabilities in network appliances, it deserves extra attention.

What changes

Both new rules are enabled with a Block action from the start, rather than Log. That means matching malicious requests get stopped on the spot instead of just being recorded. If you run Citrix NetScaler or Kemp LoadMaster in your infrastructure, or sit them behind Cloudflare, your protection improves with no extra work on your end.

Dive Deep

Let's look at what the original post says about each vulnerability.

CVE-2026-8451 (Citrix NetScaler ADC / Gateway)

This affects NetScaler ADC / Gateway appliances configured as a SAML Identity Provider (IdP). The root cause is insufficient input validation. Here's how the post describes it.

Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.

An unauthenticated, remote attacker can send a malformed request to trigger a memory overread and leak fragments of sensitive data from adjacent appliance memory.

CVE-2026-8037 (Progress Kemp LoadMaster)

This is an OS command injection vulnerability in Progress Kemp LoadMaster load balancers. It's rated critical, since an unauthenticated remote attacker can achieve full remote code execution (RCE).

Both rules are new detections in the Cloudflare Managed Ruleset, with the action set to Block.

Wrap-up

  • A WAF release dated 2026-07-14 landed in the Cloudflare Managed Ruleset
  • A new Block rule now covers the Citrix NetScaler ADC / Gateway memory disclosure flaw (CVE-2026-8451)
  • A new Block rule now covers the Progress Kemp LoadMaster pre-auth RCE flaw (CVE-2026-8037)
  • If you use the Cloudflare Managed Ruleset, your protection updates automatically — but if you run Citrix NetScaler or Kemp LoadMaster yourself, it's worth checking your own patching status too.

Related posts