JA EN
shiichan

Cloudflare WAF Adds a Rule for the F5 BIG-IP Flaw CVE-2026-94127!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! Today I'm looking at the regular Cloudflare WAF release.

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog has a WAF Release dated 2026-10-06. It adds a new detection for an F5 BIG-IP heap-based buffer overflow and strengthens command injection protections.

The vulnerability in focus:

  • CVE-2026-94127: a heap-based buffer overflow in F5 BIG-IP. Attackers can exploit it to execute arbitrary code on the affected system

Why it matters

BIG-IP often sits at the edge of a network, so a flaw that allows unauthenticated arbitrary code execution is a big deal. Having a WAF layer that can block attacks while you patch is reassuring.

What changes

There are three changes in the Cloudflare Managed Ruleset:

  • Command Injection - Generic 8 - uri - Beta: action changed from Log to Block, and merged into the original rule "Command Injection - Generic 8 - uri" (ID ending ...ee159e2e)
  • F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127: a new detection with the action Block
  • Next.js - Cache Poisoning - CVE:CVE-2026-94543: stays at Block. Only the rule metadata description was refined; the detection is unchanged

In short, tested beta logic now lives in the baseline rule, which strengthens the default protection.

Dive Deep

What we can read from the table in the post:

  • All three rules belong to the Cloudflare Managed Ruleset
  • The Legacy Rule ID is N/A for each
  • The new rule's ID ends with ...7206c737, and the Next.js rule's ID ends with ...549f7356

The post doesn't go into further technical detail, such as specific attack patterns.

Wrap-up

  • A new rule blocks exploitation of F5 BIG-IP CVE-2026-94127 (heap overflow)
  • The beta logic for Command Injection - Generic 8 - uri is merged into the baseline rule
  • The Next.js cache poisoning rule (CVE-2026-94543) only got a clearer description; detection is unchanged

Worth a look for anyone on the Cloudflare Managed Ruleset, especially teams running BIG-IP!

Related posts