--- title: Application security Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) Application security ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) May 07, 2026 1. ### [WAF and framework adapter mitigations for React and Next.js vulnerabilities](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-06-react-nextjs-vulnerabilities/) [ Workers ](https://edgetunnel-b2h.pages.dev/workers/)[ WAF ](https://edgetunnel-b2h.pages.dev/waf/) Multiple security vulnerabilities were disclosed by the React team and Vercel affecting React Server Components and Next.js. These include denial of service, middleware and proxy bypass, server-side request forgery, cross-site scripting, and cache poisoning issues across a range of severity levels. **We strongly recommend updating your application and its dependencies immediately.** Patched versions are available for React (`react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` `19.0.6`, `19.1.7`, and `19.2.6`) and Next.js (`15.5.16` and `16.2.5`). #### WAF protections Cloudflare WAF rules deployed in response to prior React Server Component CVEs ([CVE-2025-55184 ↗](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) and [CVE-2026-23864 ↗](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg)) already provide coverage for the newly disclosed denial-of-service vulnerabilities. These rules are enabled by default with a Block action for all customers using the Cloudflare Managed Ruleset, including Free plan customers using the Free Managed Ruleset. | Ruleset | Rule description | Rule ID | Default action | | -------------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------- | -------------- | | Cloudflare Managed Ruleset | React - DoS - [CVE-2025-55184 ↗](https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956) | 2694f1610c0b471393b21aef102ec699 | Block | | Cloudflare Managed Ruleset | React - DoS - [CVE-2026-23864 ↗](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg) | aaede80b4d414dc89c443cea61680354 | Block | The existing rules detect the underlying attack patterns generically. As a result, they apply to the new [CVE-2026-23870 ↗](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) denial-of-service vulnerability in Server Components and the corresponding Next.js advisory [GHSA-8h8q-6873-q5fj ↗](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj). Cloudflare is investigating whether WAF rules can be safely and effectively deployed for three of the high-severity advisories: [CVE-2026-23870 ↗](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) / [GHSA-8h8q-6873-q5fj ↗](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj), [GHSA-267c-6grr-h53f ↗](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f), and [GHSA-mg66-mrh9-m8jx ↗](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx). If it is possible to create a managed WAF rule that mitigates these CVEs and does not potentially break application behavior, Cloudflare will add additional managed WAF rules. These rules will be announced through the [WAF changelog](https://edgetunnel-b2h.pages.dev/waf/change-log/changelog/). Because these vulnerabilities were shared with Cloudflare with minimal advance notice, we are still investigating what WAF mitigations are possible. Several of the disclosed vulnerabilities are not possible to block in WAF. We strongly recommend updating your applications so they are not purely reliant on WAF mitigations. Customers on Pro, Business, or Enterprise plans should ensure that [Managed Rules are enabled](https://edgetunnel-b2h.pages.dev/waf/get-started/#1-deploy-the-cloudflare-managed-ruleset). #### Next.js adapters **Vinext:** [Vinext ↗](https://github.com/cloudflare/vinext) is a Vite plugin that reimplements the Next.js API surface. Vinext's latest release is not vulnerable to any of the disclosed CVEs. Vinext's architecture differs from stock Next.js in ways that sidestep the affected code paths. For example, it does not implement the PPR resume protocol, does not expose Pages Router data-route endpoints, and strips internal headers such as `x-nextjs-data` at request boundaries. As an extra layer of defense, we added a React `19.2.6` or later requirement when running `vinext init` ([PR #1118 ↗](https://github.com/cloudflare/vinext/pull/1118), [PR #1112 ↗](https://github.com/cloudflare/vinext/pull/1112)) to prevent accidentally running a vulnerable version of React with Vinext. **OpenNext on Cloudflare:** OpenNext is an adapter that lets you deploy Next.js apps to the Cloudflare Workers platform. OpenNext itself is not directly vulnerable to the React denial-of-service CVE, but users must update the Next.js version in their application. The OpenNext team has updated the adapter to further harden against these vectors and released a new version of the Cloudflare adapter. Test fixtures and examples have been updated to use patched versions ([PR #1255 ↗](https://github.com/opennextjs/opennextjs-cloudflare/pull/1255)). #### Summary of disclosed vulnerabilities | Advisory | Severity | Issue | WAF status | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-23870 ↗](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh) / [GHSA-8h8q-6873-q5fj ↗](https://github.com/vercel/next.js/security/advisories/GHSA-8h8q-6873-q5fj) | High | Denial of service in Server Components | **WAF rules in place:** 2694f1610c0b471393b21aef102ec699, aaede80b4d414dc89c443cea61680354Cloudflare is investigating additional managed WAF coverage | | [GHSA-267c-6grr-h53f ↗](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) | High | Middleware bypass via segment-prefetch routes | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule | | [GHSA-mg66-mrh9-m8jx ↗](https://github.com/vercel/next.js/security/advisories/GHSA-mg66-mrh9-m8jx) | High | Denial of service via connection exhaustion in Cache Components | Cloudflare is investigating if this can be safely and effectively mitigated by a managed WAF rule | | [GHSA-492v-c6pp-mqqv ↗](https://github.com/vercel/next.js/security/advisories/GHSA-492v-c6pp-mqqv) | High | Middleware bypass via dynamic route parameter injection | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-c4j6-fc7j-m34r ↗](https://github.com/vercel/next.js/security/advisories/GHSA-c4j6-fc7j-m34r) | High | SSRF via WebSocket upgrades | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-36qx-fr4f-26g5 ↗](https://github.com/vercel/next.js/security/advisories/GHSA-36qx-fr4f-26g5) | High | Middleware bypass in Pages Router i18n | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-ffhc-5mcf-pf4q ↗](https://github.com/vercel/next.js/security/advisories/GHSA-ffhc-5mcf-pf4q) | Moderate | XSS via CSP nonces | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-gx5p-jg67-6x7h ↗](https://github.com/vercel/next.js/security/advisories/GHSA-gx5p-jg67-6x7h) | Moderate | XSS in beforeInteractive scripts | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-h64f-5h5j-jqjh ↗](https://github.com/vercel/next.js/security/advisories/GHSA-h64f-5h5j-jqjh) | Moderate | Denial of service in Image Optimization API | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-wfc6-r584-vfw7 ↗](https://github.com/vercel/next.js/security/advisories/GHSA-wfc6-r584-vfw7) | Moderate | Cache poisoning in RSC responses | Custom WAF rule possible; global managed rule could potentially break application behavior | | [GHSA-vfv6-92ff-j949 ↗](https://github.com/vercel/next.js/security/advisories/GHSA-vfv6-92ff-j949) | Low | Cache poisoning via RSC cache-busting collisions | Not possible to safely enable a managed WAF rule without potentially breaking application behavior | | [GHSA-3g8h-86w9-wvmq ↗](https://github.com/vercel/next.js/security/advisories/GHSA-3g8h-86w9-wvmq) | Low | Middleware redirect cache poisoning | Custom WAF rule possible; global managed rule could potentially break application behavior | May 07, 2026 1. ### [CSV export and adjustable page density for RFIs](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-07-csv-export-for-rfis/) [ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/) You can now export your Requests for Information (RFI) history to a **CSV document** and customize your dashboard view by choosing how many RFI records to load per page. #### Why this matters These quality-of-life updates focus on data portability and dashboard performance, allowing power users to manage high volumes of requests more efficiently: * The new **CSV export** allows you to move RFI data into external tools for custom reporting, internal auditing, or cross-referencing with other security projects without manual data entry * With **adjustable page density**, you can now choose to load more records at once (10, 25 or 50) to scan through history faster Cloudforce One subscribers can find these new options in [Cloudflare Dashboard > Application Security > Threat Intelligence > Requests for Information ↗](https://dash.cloudflare.com/?to=/:account/application-security/threat-intelligence/requests). May 07, 2026 1. ### [WAF Release - 2026-05-07 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-07-emergency-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This emergency release introduces a new rule to detect Next.js App Router middleware and proxy bypass attempts via segment-prefetch routes (CVE-2026-44575). **Key Findings** CVE-2026-44575: Next.js Middleware / Proxy Bypass in App Router Applications via Segment-Prefetch Routes Successful exploitation allows unauthenticated attackers to bypass middleware or proxy-based authorization checks in affected Next.js App Router applications. This leads to unauthorized access to protected content, potential exposure of sensitive application data, and compromise of application security boundaries. We strongly recommend upgrading to Next.js 15.5.16 or 16.2.5 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, enforce authorization in the underlying route or page logic instead of relying solely on middleware. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ----------------------------------------------------------------------- | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...e77e4a53 | N/A | Next.js - Middleware Bypass via Invalid RSC Header - CVE:CVE-2026-44575 | N/A | Disabled | This is a new detection. | May 06, 2026 1. ### [TAXII support added to Threat Events API](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-06-taxii-support-for-threat-events-api/) [ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/) The Cloudforce One Threat Events API now supports [**TAXII** ↗](https://www.cloudflare.com/en-gb/learning/security/what-is-stix-and-taxii/) as an output format, enabling standardized, automated sharing of cyber threat intelligence with your existing security stack. #### Why this matters * You can now ingest Cloudforce One threat data directly into your SIEM, TIP or SOAR tools that prefer TAXII-formatted streams without needing custom translation scripts. * By supporting the TAXII format parameter in our API, security teams can automate the synchronization of indicator data, reducing the manual overhead of updating blocklists and detection rules. * This alignment with industry standards ensures that your threat data remains consistent across different security ecosystems and partner integrations. #### How to use it When calling the Threat Events API, you can now specify `taxii` in the `format` query parameter: `GET /accounts/{account_id}/cloudforce_one/threat_events?format=taxii` You can find the updated documentation in the [Cloudflare API Reference ↗](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce%5Fone/subresources/threat%5Fevents/methods/list#%28resource%29%20cloudforce%5Fone.threat%5Fevents%20%3E%20%28method%29%20list%20%3E%20%28params%29%20default%20%3E%20%28param%29%20format%20%3E%20%28schema%29). May 04, 2026 1. ### [WAF Release - 2026-05-04](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-04-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release focuses on new detections to expand coverage across command injection, SQL injection, PHP object injection, remote code execution, and XSS attack vectors. **Key Findings** * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------- | --------------- | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...f0884a68 | N/A | XSS, HTML Injection - Object Tag - Body (beta) | Log | Block | This is a new detection. This rule is merged into the original rule "XSS, HTML Injection - Object Tag" (ID: ...0c14e284 ). | | Cloudflare Managed Ruleset | ...ff012303 | N/A | XSS, HTML Injection - Object Tag - Headers | Log | Block | This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - Headers (beta)" is now renamed to "XSS, HTML Injection - Object Tag - Headers". | | Cloudflare Managed Ruleset | ...16f921d9 | N/A | XSS, HTML Injection - Object Tag - URI | Log | Block | This is a new detection. The rule previously known as "XSS, HTML Injection - Object Tag - URI (beta)" is now renamed to "XSS, HTML Injection - Object Tag - URI". | | Cloudflare Managed Ruleset | ...dc90d21a | N/A | Command Injection - Generic 9 - Body Vector - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Body Vector" (ID: ...0677175f ) | | Cloudflare Managed Ruleset | ...f8960375 | N/A | Command Injection - Generic 9 - Header Vector - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - Header Vector" (ID: ...1eb7a999 ) | | Cloudflare Managed Ruleset | ...ef47a800 | N/A | Command Injection - Generic 9 - URI Vector - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 9 - URI Vector" (ID: ...97321c6c ) | | Cloudflare Managed Ruleset | ...beebf804 | N/A | Command Injection - Sleep - Body | N/A | Disabled | This is a new detection. The rule previously known as "Command Injection Sleep" is now renamed to "Command Injection - Sleep - Body". | | Cloudflare Managed Ruleset | ...0d257566 | N/A | Command Injection - Sleep - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1856fe86 | N/A | Command Injection - Sleep - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...e6e43c37 | N/A | Fortinet FortiSandbox - Command Injection - CVE:CVE-2026-39808 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...88118795 | N/A | Remote Code Execution - Common Bash Bypass - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...9299d53b | N/A | Remote Code Execution - Common Bash Bypass - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...b0bf33f9 | N/A | Remote Code Execution - Common Bash Bypass - Body - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "Remote Code Execution - Common Bash Bypass Body" (ID: ...efb7e5b9 ). The rule previously known as "Remote Code Execution - Common Bash Bypass Beta" is now renamed to "Remote Code Execution - Common Bash Bypass Body". | | Cloudflare Managed Ruleset | ...33bfe8b9 | N/A | PHP Object Injection - 2 - Body - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "PHP Object Injection - 2" (ID: ...161aafdc ) | | Cloudflare Managed Ruleset | ...29552387 | N/A | PHP Object Injection - 2 - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...8104f4c5 | N/A | PHP Object Injection - 2 - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...6a46201e | N/A | SQLi - DROP - 2 - Beta | N/A | Disabled | This is a new detection. This rule is merged into the original rule "SQLi - DROP - 2" (ID: ...48ac2221 ) | | Cloudflare Managed Ruleset | ...8b7f85ee | N/A | SQLi - DROP - 2 - Headers | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1546b5f0 | N/A | SQLi - DROP - 2 - URI | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1e053dce | N/A | SmarterMail - Remote Code Execution - CVE:CVE-2026-24423 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...d0023a36 | N/A | SQLi - SELECT Expression - Body | Block | Disabled | Action changed | | Cloudflare Managed Ruleset | ...26cc211f | N/A | SQLi - String Concatenation - URI | Block | Disabled | Action changed | Apr 30, 2026 1. ### [WAF Release - 2026-04-30 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-30-emergency-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This emergency release introduces a new rule to block a cPanel & WHM Authentication Bypass related to CVE-2026-41940. **Key Findings** * CVE-2026-41940: A critical authentication bypass vulnerability in cPanel & WHM allows unauthenticated remote attackers to bypass authentication mechanisms and gain unauthorized administrative access to the web hosting control panel. This vulnerability affects the session validation logic, enabling attackers to craft malicious requests that circumvent normal authentication checks. **Impact** Successful exploitation allows unauthenticated attackers to gain administrative control over affected cPanel & WHM installations. This leads to complete server compromise, potential theft or manipulation of hosted data, and significant service disruption across managed environments. We strongly recommend applying official vendor patches for cPanel & WHM immediately to address the underlying vulnerability. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ----------------------------------------- | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...eb2b9e2f | N/A | cPanel - Auth Bypass - CVE:CVE-2026-41940 | N/A | Block | This is a new detection. | Apr 27, 2026 1. ### [Unified workspace for Brand Protection](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-unified-workspace-brand-protection/) [ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/) We have introduced a unified investigation workspace within Brand Protection to help analysts manage complex brand portfolios. Instead of jumping between individual queries, you can now consolidate your workflow into a single, cohesive view. #### What's new * You can now elect multiple saved queries from your dashboard to generate a consolidated "Combined Matches" view. This allows you to triage results from different brand queries in one unified table * You can open query extended views in distinct tabs within the Brand Protection dashboard. This enables you to maintain multiple investigation contexts simultaneously and switch between them without losing your place. * You can reset your workspace using the new "Clear Selection" action, making it easier to pivot between different investigation sets. #### Key benefits * Eliminate fragmented workflows by viewing all matches across different query buckets in a single table, reducing the need to click through dozens of individual query pages * Correlate related campaigns by seeing similar domains or infrastructure patterns that appear across multiple saved queries Learn more in our [Brand Protection documentation](https://edgetunnel-b2h.pages.dev/security-center/brand-protection/). Apr 27, 2026 1. ### [WAF Release - 2026-04-27](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release focuses on new improvements to enhance coverage. **Key Findings** * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------- | --------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...80cec1dd | N/A | PostgreSQL - SQLi - COPY - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "PostgreSQL - SQLi - COPY - Body (ID: ...e7265a4e ). The rule previously known as "PostgreSQL - SQLi - COPY" is now renamed to "PostgreSQL - SQLi - COPY - Body". | | Cloudflare Managed Ruleset | ...2903de89 | N/A | PostgreSQL - SQLi - COPY - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1036cfa6 | N/A | PostgreSQL - SQLi - COPY - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...55ff389e | N/A | SQLi - AND/OR MAKE\_SET/ELT - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - AND/OR MAKE\_SET/ELT - Body" (ID: ...252d3934 ). The rule previously known as "SQLi - AND/OR MAKE\_SET/ELT" is now renamed to "SQLi - AND/OR MAKE\_SET/ELT - Body". | | Cloudflare Managed Ruleset | ...346487f9 | N/A | SQLi - AND/OR MAKE\_SET/ELT - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1ac6ceca | N/A | SQLi - AND/OR MAKE\_SET/ELT - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...dd471337 | N/A | SQLi - Common Patterns - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Common Patterns - Body" (ID: ...cb5d0b9b ). The rule previously known as "SQLi - Common Patterns" is now renamed to "SQLi - Common Patterns - Body". | | Cloudflare Managed Ruleset | ...975c07b7 | N/A | SQLi - Common Patterns - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...05b1b06b | N/A | SQLi - Common Patterns - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...dd0ba3c7 | N/A | SQLi - Equation - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Equation - Body" (ID: ...c2eb3e7f ). The rule previously known as "SQLi - Equation" is now renamed to "SQLi - Equation - Body". | | Cloudflare Managed Ruleset | ...3d1c2384 | N/A | SQLi - Equation - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...e1149ea6 | N/A | SQLi - Equation - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...205adbb0 | N/A | SQLi - AND/OR Digit Operator Digit - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - AND/OR Digit Operator Digit - Body" (ID: ...3893c564 ). The rule previously known as "SQLi - AND/OR Digit Operator Digit" is now renamed to "SQLi - AND/OR Digit Operator Digit - Body". | | Cloudflare Managed Ruleset | ...ad2abbaa | N/A | SQLi - AND/OR Digit Operator Digit - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...53acbc0d | N/A | SQLi - AND/OR Digit Operator Digit - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...2b45a97d | N/A | SQLi - Benchmark Function - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Benchmark Function - Body" (ID: ...2ebc44ad ). The rule previously known as "SQLi - Benchmark Function" is now renamed to "SQLi - Benchmark Function - Body". | | Cloudflare Managed Ruleset | ...9889aadc | N/A | SQLi - Benchmark Function - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...491b28e9 | N/A | SQLi - Benchmark Function - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...2aa649de | N/A | SQLi - Comparison - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Comparison - Body" (ID: ...e7907480 ). The rule previously known as "SQLi - Comparison" is now renamed to "SQLi - Comparison - Body". | | Cloudflare Managed Ruleset | ...39e3e013 | N/A | SQLi - Comparison - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...f4bdb492 | N/A | SQLi - Comparison - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a1ff3b34 | N/A | SQLi - String Concatenation - Body - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - String Concatenation - Headers" (ID: ...2116d2fe ).The rule previously known as "SQLi - String Concatenation - Headers" is now renamed to "SQLi - String Concatenation - Body". | | Cloudflare Managed Ruleset | ...0d0e6c3b | N/A | SQLi - String Concatenation - Headers | Log | Block | This is a new detection.(Former Id was ...846d1940 ) | | Cloudflare Managed Ruleset | ...26cc211f | N/A | SQLi - String Concatenation - URI | Log | Block | This is a new detection. (Former Id was ...8fae8c84 ) | | Cloudflare Managed Ruleset | ...eacc78ab | N/A | SQLi - SELECT Expression - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - SELECT Expression - Body" (ID: ...d0023a36 ). The rule previously known as "SQLi - SELECT Expression" is now renamed to "SQLi - SELECT Expression - Body". | | Cloudflare Managed Ruleset | ...630bb223 | N/A | SQLi - SELECT Expression - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...dcd6efb5 | N/A | SQLi - SELECT Expression - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...18c47cea | N/A | SQLi - ORD and ASCII - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - ORD and ASCII- Body" (ID: ...d0d207f9 ). The rule previously known as "SQLi - ORD and ASCII" is now renamed to "SQLi - ORD and ASCII- Body". | | Cloudflare Managed Ruleset | ...bdb1618f | N/A | SQLi - ORD and ASCII - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1d0906b6 | N/A | SQLi - ORD and ASCII - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...9fe4eff5 | N/A | SQLi - Destructive Operations | Log | Block | This is a new detection. | Apr 21, 2026 1. ### [WAF Release - 2026-04-21](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-21-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers. **Key Findings** * Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise. * Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce. **Impact** Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities. **Continuous Rule Improvements** We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ---------------------------------------------------------------------- | --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...ee159e2e | N/A | Command Injection - Generic 8 - uri | Log | Block | This is a new detection. Previous description was "Command Injection - Generic 8 - uri - Beta" | | Cloudflare Managed Ruleset | ...a15308cf | N/A | Command Injection - Generic 8 - body - Beta | Disabled | Disabled | This is a new detection. This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: ...413592e2 ). The rule previously known as "Command Injection - Generic 8" is now renamed to "Command Injection - Generic 8 - body". | | Cloudflare Managed Ruleset | ...958047ed | N/A | MySQL - SQLi - Executable Comment - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "MySQL - SQLi - Executable Comment - Body" (ID: ...7bd2d8fa ) The rule previously known as "MySQL - SQLi - Executable Comment" is now renamed to "MySQL - SQLi - Executable Comment - Body". | | Cloudflare Managed Ruleset | ...582cc559 | N/A | MySQL - SQLi - Executable Comment - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a16639d3 | N/A | MySQL - SQLi - Executable Comment - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...44f24211 | N/A | Magento 2 - Unrestricted file upload - 2 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...bf170a17 | N/A | Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...8c2ac1a7 | N/A | SQLi - Sleep Function - Beta | Log | Block | This is a new detection. This rule is merged into the original rule "SQLi - Sleep Function" (ID: ...f77e8d54 ) | | Cloudflare Managed Ruleset | ...4dacaeb8 | N/A | SQLi - Sleep Function - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...ed4c9ece | N/A | SQLi - Sleep Function - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...1dfa64df | N/A | SQLi - Probing - uri | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...4c62e2e7 | N/A | SQLi - Probing - header | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...aab28ea1 | N/A | SQLi - Probing - body | Disabled | Disabled | This is a new detection. This rule is merged into the original rule "SQLi - Probing" (ID: ...b4026c88 ) | | Cloudflare Managed Ruleset | ...20999be0 | N/A | SQLi - Probing 2 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. | | Cloudflare Managed Ruleset | ...d7aa0008 | N/A | SQLi - UNION in MSSQL - Body | Disabled | Disabled | This rule has been renamed to differentiate from "SQLi - UNION in MSSQL" (ID: ...ee5e35fd ) and contains updated rule logic. | | Cloudflare Managed Ruleset | ...a67d8561 | N/A | SQLi - UNION - 3 | Disabled | Disabled | This rule had duplicate detection logic and has been deprecated. | | Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI | Disabled | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...70282f38 | N/A | XSS, HTML Injection - Embed Tag - Headers | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...23f4d718 | N/A | XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...6978def1 | N/A | XSS, HTML Injection - Link Tag - Headers | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI | Disabled | Disabled | This is a new detection. | Apr 20, 2026 1. ### [Archive and audit security action items](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-27-archive-and-audit-security-action-items/) [ Security Overview ](https://edgetunnel-b2h.pages.dev/security/overview/) #### Archive and audit security action items Introducing enhanced archiving capabilities for security action items within the Security Overview dashboard. This update allows security teams to maintain a cleaner workspace by removing resolved, accepted, or irrelevant items from their active list while maintaining a clear paper trail for compliance. --- #### Why this matters Managing a high volume of security insights can be overwhelming. Previously, users lacked a structured way to dismiss items without losing the context of why they were ignored. With these new archiving options—**False Positive**, **Accept Risk**, and **Other**—you can now suppress items indefinitely with required rationale text for risk-based decisions. This ensures that your team remains focused on critical, actionable vulnerabilities while preserving institutional knowledge for audits. #### Key features * **Structured Archiving:** Choose from specific categories to define why an action item is being moved. * **Required Rationale:** For "Accept Risk" and "Other" categories, users must provide documentation, ensuring accountability for security decisions. * **Audit Log Transparency:** New API endpoints allow you to programmatically retrieve the history of status changes and rationale for any insight at the account or zone level. * **Reversible Actions:** Any archived item can be moved back to the active list at any time if the security context changes. Note Archiving a suspicious activity item will remove it from the Security Overview page, but the activity will remain visible in your Security Analytics dashboard for deeper forensic analysis. --- #### Example: Retrieve audit logs via API To review the history and rationale of a specific archived issue at the account level, you can use the following API command: ```bash curl "[https://api.cloudflare.com/client/v4/accounts/](https://api.cloudflare.com/client/v4/accounts/){account_id}/insights/{insight_id}/audit-log" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" ``` Apr 15, 2026 1. ### [WAF Release - 2026-04-15](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-15-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869). **Key Findings** * Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters. * FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests. * Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body. **Impact** Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------------- | --------------- | ---------- | ------------------------------------------------------------------------------------------------------------------ | | Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354 ) | | Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. | Apr 14, 2026 1. ### [Email obfuscation decode script is now non-render-blocking](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-14-email-obfuscation-defer/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) The decode script injected by [Email Address Obfuscation](https://edgetunnel-b2h.pages.dev/waf/tools/scrape-shield/email-address-obfuscation/) now loads with the `defer` attribute. This means the script no longer blocks page rendering. It downloads in parallel with HTML parsing and executes after the document is fully parsed, before the `DOMContentLoaded` event. This improves page loading performance, contributing to better Core Web Vitals, for all zones with Email Address Obfuscation on. No action is required. If you have custom JavaScript that depends on email addresses being decoded at a specific point during page load, note that the decode script now executes after HTML parsing completes rather than inline during parsing. Apr 08, 2026 1. ### [Real-time alerts and daily digests for Threat Events](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-08-threat-events-notification/) [ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/) You can now automate your threat monitoring by setting up custom alerts in your saved views. Instead of manually checking the dashboard for updates, you can subscribe to notifications that trigger whenever new data matches your specific filter sets, like new activity associated to a particular threat actor or spikes in activity within your industry. #### Stay ahead of emerging threats By linking your saved views to the Cloudflare Notifications Center, you can ensure the right information reaches your team at the right time. * **Immediate Alerts**: receive real-time notifications the moment a critical event is detected that matches your saved criteria. This is essential for high-priority monitoring, such as tracking active campaigns from specific APT groups. * **Daily Digests**: opt for a summarized report delivered once a day. This is ideal for maintaining situational awareness of broader trends, like regional activity shifts or industry-wide threat landscapes, without cluttering your inbox. ![Threat Events notifications](https://edgetunnel-b2h.pages.dev/_astro/threat-events-notifications.3Fl8LGOn_S9A1r.webp) #### How to get started To set up an alert, go to **Application Security** \> **Threat Intelligence** \> **Threat Events**. From there: 1. Choose your datasets and apply your desired filters and select **Save View** (or select an existing one). 2. Open the **Manage Saved Views** menu. 3. Select **Add Alert** next to your chosen view to configure your notification preferences in the Cloudflare dashboard. For more technical details on configuring notifications, refer to the [Threat Events documentation](https://edgetunnel-b2h.pages.dev/security-center/cloudforce-one/). Apr 07, 2026 1. ### [Manage mTLS and BYO CA certificates from the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-07-mtls-byoca-dashboard/) [ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/) You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required. Previously, these advanced workflows required the Cloudflare API. The following are now available in the dashboard: * **AOP certificate management** — Upload and manage your own certificate authorities for [Authenticated Origin Pulls (AOP)](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/)directly from the dashboard. * **BYO Client mTLS certificate management** — Upload and manage your own CA certificates for [client mTLS enforcement](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/)without needing API access. * **CDN hostname to client mTLS certificate mapping** — Associate client mTLS certificates with specific hostnames directly from the dashboard. Apr 07, 2026 1. ### [WAF Release - 2026-04-07](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-07-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging "OnEvent" handlers within HTTP cookies. **Key Findings** * MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution. * SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation. * XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values. **Impact** Successful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ------------------------------------------------------- | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a78ad04e | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. | Apr 01, 2026 1. ### [New QUIC RTT and delivery rate fields](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-01-l4-transport-telemetry-fields/) [ Rules ](https://edgetunnel-b2h.pages.dev/rules/) Two new fields are now available in rule expressions that surface Layer 4 transport telemetry from the client connection. Together with the existing [cf.timings.client\_tcp\_rtt\_msec](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/) field, these fields give you a complete picture of connection quality for both TCP and QUIC traffic — enabling transport-aware rules without requiring any client-side changes. Previously, QUIC RTT and delivery rate data was only available via the `Server-Timing: cfL4` response header. These new fields make the same data available directly in rule expressions, so you can use them in Transform Rules, WAF Custom Rules, and other phases that support dynamic fields. #### New fields | Field | Type | Description | | ---------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | cf.timings.client\_quic\_rtt\_msec | Integer | The smoothed QUIC round-trip time (RTT) between Cloudflare and the client in milliseconds. Only populated for QUIC (HTTP/3) connections. Returns 0 for TCP connections. | | cf.edge.l4.delivery\_rate | Integer | The most recent data delivery rate estimate for the client connection, in bytes per second. Returns 0 when L4 statistics are not available for the request. | #### Example: Route slow connections to a lightweight origin Use a request header transform rule to tag requests from high-latency connections, so your origin can serve a lighter page variant: **Rule expression:** ```txt cf.timings.client_tcp_rtt_msec > 200 or cf.timings.client_quic_rtt_msec > 200 ``` **Header modifications:** | Operation | Header name | Value | | --------- | -------------- | ----- | | Set | X-High-Latency | true | #### Example: Match low-bandwidth connections ```txt cf.edge.l4.delivery_rate > 0 and cf.edge.l4.delivery_rate < 100000 ``` For more information, refer to [Request Header Transform Rules](https://edgetunnel-b2h.pages.dev/rules/transform/request-header-modification/) and the [fields reference](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/). Mar 30, 2026 1. ### [WAF Release - 2026-03-30](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-30-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts. Additionally, this release includes targeted protection for a high-impact unrestricted file upload vulnerability in Magento and Adobe Commerce. **Key Findings** * CVE-2025-59718: An improper cryptographic signature verification vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication using a maliciously crafted SAML message, if that feature is enabled on the device. * Magento 2 - Unrestricted File Upload: A critical flaw in Magento and Adobe Commerce allows unauthenticated attackers to bypass security checks and upload malicious files to the server, potentially leading to Remote Code Execution (RCE). **Impact** Successful exploitation of the Fortinet and Magento vulnerabilities could allow unauthenticated attackers to gain administrative control or deploy webshells, leading to complete server compromise and data theft. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | -------------------------------------------------------------------- | --------------- | ---------- | ------------------------ | | Cloudflare Managed Ruleset | ...2f7f95e9 | N/A | Generic Rules - Parameter Pollution - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...319731a4 | N/A | Generic Rules - Parameter Pollution - Header - Form | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...def262dd | N/A | Generic Rules - Parameter Pollution - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...70a36147 | N/A | Magento 2 - Unrestricted file upload | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...2ffcca9f | N/A | Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718 | Log | Block | This is a new detection. | Mar 25, 2026 1. ### [New mTLS certificate fields for Transform Rules](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-25-rfc9440-mtls-fields/) [ Rules ](https://edgetunnel-b2h.pages.dev/rules/) Cloudflare now exposes four new fields in the Transform Rules phase that encode client certificate data in [RFC 9440 ↗](https://www.rfc-editor.org/rfc/rfc9440) format. Previously, forwarding client certificate information to your origin required custom parsing of PEM-encoded fields or non-standard HTTP header formats. These new fields produce output in the standardized `Client-Cert` and `Client-Cert-Chain` header format defined by RFC 9440, so your origin can consume them directly without any additional decoding logic. Each certificate is DER-encoded, Base64-encoded, and wrapped in colons. For example, `:MIIDsT...Vw==:`. A chain of intermediates is expressed as a comma-separated list of such values. #### New fields | Field | Type | Description | | ----------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | cf.tls\_client\_auth.cert\_rfc9440 | String | The client leaf certificate in RFC 9440 format. Empty if no client certificate was presented. | | cf.tls\_client\_auth.cert\_rfc9440\_too\_large | Boolean | true if the leaf certificate exceeded 10 KB and was omitted. In practice this will almost always be false. | | cf.tls\_client\_auth.cert\_chain\_rfc9440 | String | The intermediate certificate chain in RFC 9440 format as a comma-separated list. Empty if no intermediate certificates were sent or if the chain exceeded 16 KB. | | cf.tls\_client\_auth.cert\_chain\_rfc9440\_too\_large | Boolean | true if the intermediate chain exceeded 16 KB and was omitted. | The chain encoding follows the same ordering as the TLS handshake: the certificate closest to the leaf appears first, working up toward the trust anchor. The root certificate is not included. #### Example: Forwarding client certificate headers to your origin server Add a request header transform rule to set the `Client-Cert` and `Client-Cert-Chain` headers on requests forwarded to your origin server. For example, to forward headers for verified, non-revoked certificates: **Rule expression:** ```txt cf.tls_client_auth.cert_verified and not cf.tls_client_auth.cert_revoked ``` **Header modifications:** | Operation | Header name | Value | | --------- | ----------------- | ----------------------------------------- | | Set | Client-Cert | cf.tls\_client\_auth.cert\_rfc9440 | | Set | Client-Cert-Chain | cf.tls\_client\_auth.cert\_chain\_rfc9440 | To get the most out of these fields, upload your client CA certificate to Cloudflare so that Cloudflare validates the client certificate at the edge and populates `cf.tls_client_auth.cert_verified` and `cf.tls_client_auth.cert_revoked`. Prevent header injection You should ensure that `Client-Cert` and `Client-Cert-Chain` headers received by your origin server can only originate from this transform rule — any client could send these headers directly. * **If you use WAF custom rules to block requests with invalid mTLS connections:** The transform rule is sufficient. For all requests that reach your origin server, the rule will overwrite any existing `Client-Cert` and `Client-Cert-Chain` headers. * **If you do not enforce mTLS at the WAF:** Add another transform rule that removes any incoming `Client-Cert` and `Client-Cert-Chain` headers from all requests (use expression `true`), ordered before the rule above. This ensures your origin server cannot receive client-supplied values for these HTTP headers. For more information, refer to [Mutual TLS authentication](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/service-credentials/mutual-tls-authentication/), [Request Header Transform Rules](https://edgetunnel-b2h.pages.dev/rules/transform/request-header-modification/), and the [fields reference](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/). Mar 23, 2026 1. ### [Web Assets fields now available in GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-23-web-assets-graphql-fields/) [ API Shield ](https://edgetunnel-b2h.pages.dev/api-shield/) Two new fields are now available in the `httpRequestsAdaptive` and `httpRequestsAdaptiveGroups` [GraphQL Analytics API](https://edgetunnel-b2h.pages.dev/analytics/graphql-api/) datasets: * `webAssetsOperationId` — the ID of the [saved endpoint](https://edgetunnel-b2h.pages.dev/api-shield/management-and-monitoring/) that matched the incoming request. * `webAssetsLabelsManaged` — the [managed labels](https://edgetunnel-b2h.pages.dev/api-shield/management-and-monitoring/endpoint-labels/#managed-labels) mapped to the matched operation at the time of the request (for example, `cf-llm`, `cf-log-in`). At most 10 labels are returned per request. Both fields are empty when no operation matched. `webAssetsLabelsManaged` is also empty when no managed labels are assigned to the matched operation. These fields allow you to determine, per request, which Web Assets operation was matched and which managed labels were active. This is useful for troubleshooting downstream security detection verdicts — for example, understanding why [AI Security for Apps](https://edgetunnel-b2h.pages.dev/waf/detections/ai-security-for-apps/) did or did not flag a request. Refer to [Endpoint labeling service](https://edgetunnel-b2h.pages.dev/api-shield/management-and-monitoring/endpoint-labels/#analytics) for GraphQL query examples. Mar 23, 2026 1. ### [WAF Release - 2026-03-23](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-23-waf-release/) [ WAF ](https://edgetunnel-b2h.pages.dev/waf/) This week's release focuses on new improvements to enhance coverage. **Key Findings** * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | -------------------------- | ----------- | -------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare Managed Ruleset | ...97321c6c | N/A | Command Injection - Generic 9 - URI Vector | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...1eb7a999 | N/A | Command Injection - Generic 9 - Header Vector | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...0677175f | N/A | Command Injection - Generic 9 - Body Vector | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...479da68f | N/A | PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132 (beta) | Log | Block | This rule has been merged into the original rule "PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132" (ID: ...824b817c ) | Mar 20, 2026 1. ### [Stream logs from multiple replicas of Cloudflare Tunnel simultaneously](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-20-tunnel-replica-overview-and-multi-log-streaming/) [ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all [replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) of that tunnel and supports streaming logs from multiple replicas at once. ![View replicas and stream logs from multiple connectors](https://edgetunnel-b2h.pages.dev/_astro/tunnel-multiconn.DEOEaLlu_ZDxArh.webp) Previously, you could only stream logs from one replica at a time. With this update: * **Replicas on the tunnel overview** — All active replicas for the selected tunnel now appear on that tunnel's overview page under **Connectors**. Select any replica to stream its logs. * **Multi-connector log streaming** — Stream logs from multiple replicas simultaneously, making it easier to correlate events across your infrastructure during debugging or incident response. To try it out, log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/) and go to **Networks** \> **Connectors** \> **Cloudflare Tunnels**. Select **View logs** next to the tunnel you want to monitor. For more information, refer to [Tunnel log streams](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) and [Deploy replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas/). Mar 19, 2026 1. ### [Manage Cloudflare Tunnels with Wrangler](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-19-wrangler-tunnel-commands/) [ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Workers ](https://edgetunnel-b2h.pages.dev/workers/) You can now manage [Cloudflare Tunnels](https://edgetunnel-b2h.pages.dev/tunnel/) directly from [Wrangler](https://edgetunnel-b2h.pages.dev/workers/wrangler/), the CLI for the Cloudflare Developer Platform. The new [wrangler tunnel](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/tunnel/) commands let you create, run, and manage tunnels without leaving your terminal. ![Wrangler tunnel commands demo](https://edgetunnel-b2h.pages.dev/_astro/wrangler-tunnel.DOqrtGGg_7EDX0.webp) Available commands: * `wrangler tunnel create` — Create a new remotely managed tunnel. * `wrangler tunnel list` — List all tunnels in your account. * `wrangler tunnel info` — Display details about a specific tunnel. * `wrangler tunnel delete` — Delete a tunnel. * `wrangler tunnel run` — Run a tunnel using the cloudflared daemon. * `wrangler tunnel quick-start` — Start a free, temporary tunnel without an account using [Quick Tunnels](https://edgetunnel-b2h.pages.dev/tunnel/setup/#quick-tunnels-development). Wrangler handles downloading and managing the [cloudflared](https://edgetunnel-b2h.pages.dev/tunnel/downloads/) binary automatically. On first use, you will be prompted to download `cloudflared` to a local cache directory. These commands are currently experimental and may change without notice. To get started, refer to the [Wrangler tunnel commands documentation](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/tunnel/). Mar 18, 2026 1. ### [Worker execution timing field now available in Rules](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-18-worker-timing-field/) [ Rules ](https://edgetunnel-b2h.pages.dev/rules/) The `cf.timings.worker_msec` field is now available in the Ruleset Engine. This field reports the wall-clock time that a Cloudflare Worker spent handling a request, measured in milliseconds. You can use this field to identify slow Worker executions, detect performance regressions, or build rules that respond differently based on Worker processing time, such as logging requests that exceed a latency threshold. #### Field details | Field | Type | Description | | ----------------------- | ------- | ------------------------------------------------------------------------------------------------- | | cf.timings.worker\_msec | Integer | The time spent executing a Cloudflare Worker in milliseconds. Returns 0 if no Worker was invoked. | Example filter expression: ```plaintext cf.timings.worker_msec > 500 ``` For more information, refer to the [Fields reference](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/fields/reference/cf.timings.worker%5Fmsec/). Mar 18, 2026 1. ### [Real-time logo match preview](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-18-brand-protection-logo-match-preview/) [ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/) We are introducing **Logo Match Preview**, bringing the same pre-save visibility to visual assets that was previously only available for string-based queries. This update allows you to fine-tune your brand detection strategy before committing to a live monitor. #### What’s new: * Upload your brand logo and immediately see a sample of potential matches from recently detected sites before finalizing the query * Adjust your similarity score (from 75% to 100%) and watch the results refresh in real-time to find the balance between broad detection and noise reduction * Review the specific logos triggered by your current settings to ensure your query is capturing the right level of brand infringement If you are ready to test your brand assets, go to the [Brand Protection dashboard ↗](https://edgetunnel-b2h.pages.dev/security-center/brand-protection/) to try the new preview tool. Mar 17, 2026 1. ### [New Security Overview UI](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-17-new-security-overview-ui/) [ Security Overview ](https://edgetunnel-b2h.pages.dev/security/overview/) The Security Overview has been updated to provide Application Security customers with more actionable insights and a clearer view of their security posture. Key improvements include: * **Criticality for all Insights**: Every insight now includes a criticality rating, allowing you to prioritize the most impactful security action items first. * **Detection Tools Section**: A new section displays the security detection tools available to you, indicating which are currently enabled and which can be activated to strengthen your defenses. * **Industry Peer Comparison** (Enterprise customers): A new module from Security Reports benchmarks your security posture against industry peers, highlighting relative strengths and areas for improvement. ![New Security Overview UI](https://edgetunnel-b2h.pages.dev/_astro/overview-ui.D7FzaCLm_Ze702A.webp) For more information, refer to [Security Overview](https://edgetunnel-b2h.pages.dev/security/overview/). ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/application-security/2/#page","headline":"Application security Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/application-security/2/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```