JA EN
shiichan

No way — Cloudflare WAF now blocks those nasty SharePoint and Rails RCEs on sight!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi, it's me, Shii-chan! I was checking Cloudflare's Changelog today and found a security update that's too good not to share!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted a WAF managed ruleset update dated 2026-08-04. The headline items are stronger protection against a Microsoft SharePoint RCE vulnerability, and a cleanup of the SSRF (Server-Side Request Forgery) detection rules.

Here are the three things worth paying attention to.

  • CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. An unauthenticated attacker can execute arbitrary code using crafted requests
  • CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage's image variant transformations. An unauthenticated attacker can perform arbitrary file reads and achieve RCE using maliciously crafted payload requests
  • Generic cloud protections: The detection logic targeting SSRF in cloud-hosted applications was improved

The story so far

Until now, traffic targeting the SharePoint RCE was only set to Log. Suspicious requests got written to logs but weren't automatically blocked.

The SSRF side was even messier. Five similarly-named rules — SSRF - Local, SSRF - Local - 2 - Beta, SSRF - Local - Beta, SSRF - Cloud - Beta, and SSRF - Cloud - 2 - Beta — were all sitting there, and all of them were Disabled. Even the main SSRF - Cloud rule was Disabled too. With so many beta variants lying around, it wasn't easy to tell which protection was actually doing anything.

What changes

This update tightens up how dangerous traffic gets handled.

  • The rule targeting the SharePoint RCE (CVE-2026-50522) switched from Log to Block. It no longer just gets logged — it gets blocked on the spot
  • The rule targeting the Rails RCE (CVE-2026-66066) was already set to Block, but its confusing "File Upload - RCE" label was renamed to something that actually reflects what it detects
  • The five scattered SSRF beta rules (SSRF - Local, SSRF - Local - 2 - Beta, SSRF - Local - Beta, SSRF - Cloud - Beta, SSRF - Cloud - 2 - Beta) were removed and consolidated into a single "SSRF - Cloud" rule
  • That SSRF - Cloud rule also switched from Disabled to Block, so it's now actually enforcing

If your team runs a web app behind Cloudflare, these rules apply automatically without you changing any settings. If your systems run SharePoint or Rails with Active Storage, this update should be a real relief.

Dive Deep

Let me break down the changed rules in a bit more detail. All of these are changes to the Cloudflare Managed Ruleset.

  • Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522 (rule ID ending 052b07cf): Log → Block. A new detection
  • Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066 (rule ID ending 3a5b40d6): Block → Block. This one was previously labeled "File Upload - RCE" — only the name changed, not the action
  • SSRF - Local (rule ID ending 8242627b): Disabled → detection removed
  • SSRF - Local - 2 - Beta (rule ID ending 743a63ec): Disabled → detection removed
  • SSRF - Local - Beta (rule ID ending 01a076eb): Disabled → detection removed
  • SSRF - Cloud - Beta (rule ID ending c2e84e2d): Disabled → detection removed
  • SSRF - Cloud - 2 - Beta (rule ID ending ab8af26f): Disabled → detection removed
  • SSRF - Cloud (rule ID ending 25ba9d7c): Disabled → Block. The source notes, "We are changing the action for this rule from Disabled to BLOCK" — this one rule now takes over the job the five removed beta rules used to share

Here's how the source describes CVE-2026-50522:

An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.

Since this lets an unauthenticated attacker reach full code execution, it's worth checking if you're running SharePoint Server on the public internet. CVE-2026-66066 targets Rails' Active Storage image variant transformations, so services that resize or transcode user-uploaded images should pay close attention too.

Wrap-up

  • The rule targeting the Microsoft SharePoint RCE (CVE-2026-50522) was upgraded from Log to Block
  • The rule targeting the Ruby on Rails Active Storage RCE (CVE-2026-66066) got a clearer name
  • Five scattered SSRF beta rules were removed and consolidated into a single "SSRF - Cloud" rule, now set to Block

This is an update you shouldn't skip if you're running web apps or APIs behind Cloudflare — especially if your team runs SharePoint or Rails!

Related posts