JA EN
shiichan

Cloudflare WAF is adding two new detections on July 13!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey there, it's me, Shii-chan! Today I've got a small but important security heads-up from Cloudflare.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog posted a scheduled change for the WAF managed ruleset. It was announced on 2026-07-06, and the changes are set to roll out on 2026-07-13. This time, two new detection rules are being added.

Here's what's coming:

  • Citrix Netscaler ADC - Insufficient Input Validation (CVE-2026-8451)
  • Progress Kemp LoadMaster - Remote Code Execution (CVE-2026-8037)

Both are marked as new detections, and the key point is that they start out in Log mode.

The story so far

WAF managed rules work by having Cloudflare add new rules every time a fresh vulnerability shows up. So you don't have to write your own signatures by hand — updates like this arrive on a regular cadence. This one is part of that routine release, giving you a heads-up about what changes next week.

What changes

Starting July 13, the WAF will be able to spot attack patterns targeting Citrix Netscaler ADC and Progress Kemp LoadMaster. Because they begin in Log mode, there's no risk of traffic suddenly getting blocked. At first they just record "hey, a request like this came in" so you can watch how things behave.

Dive Deep

Starting in Log mode means matching requests get written to your logs while the traffic itself still passes through. Once you've looked at the logs and are confident that it's a real attack, you can switch your rule's action from Log to Block in your WAF settings to actually stop it. I love that you can take it one safe step at a time, tuned to your own environment.

The target is the WAF managed ruleset. This isn't a change to existing rules — it's two brand-new detections being added.

Wrap-up

  • Cloudflare is adding two new detections to the WAF managed ruleset on 2026-07-13
  • They cover Citrix Netscaler ADC (CVE-2026-8451) and Progress Kemp LoadMaster (CVE-2026-8037)
  • Both start in Log mode, so nothing gets blocked out of the blue
  • Check your logs and switch to Block yourself if you need to

If you're using Cloudflare's WAF to guard your stack, keep the July 13 rollout in the back of your mind. It's also a nice nudge to peek at your logs and see whether any of these attacks are knocking on your door!

Related posts