---
title: Application security Changelog
image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

Application security

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

Jul 17, 2026
1. ### [WAF Release - 2026-07-17 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-17-emergency-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular web frameworks.

**Key Findings**

  * Generic Frameworks - Unauthenticated RCE: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.
  * Generic Frameworks - SQLi: Attackers can execute unauthorized database queries due to a failure to sanitize input values within request parameters.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                         | Previous Action | New Action | Comments                 |
| -------------------------- | ----------- | -------------- | ----------------------------------- | --------------- | ---------- | ------------------------ |
| Cloudflare Managed Ruleset | ...550664b6 | N/A            | Generic Rules - Unauthenticated RCE | N/A             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...ed933fcc | N/A            | Generic Rules - SQLi                | N/A             | Block      | This is a new detection. |
| Cloudflare Free Ruleset    | ...b5ec246a | N/A            | Generic Rules - Unauthenticated RCE | N/A             | Block      | This is a new detection. |
| Cloudflare Free Ruleset    | ...33697a1a | N/A            | Generic Rules - SQLi                | N/A             | Block      | This is a new detection. |

Jul 14, 2026
1. ### [WAF Release - 2026-07-14](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-14-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).

**Key Findings**

  * CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.
  * CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                              | Previous Action | New Action | Comments                 |
| -------------------------- | ----------- | -------------- | ------------------------------------------------------------------------ | --------------- | ---------- | ------------------------ |
| Cloudflare Managed Ruleset | ...76973ac4 | N/A            | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...10233f36 | N/A            | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037     | Log             | Block      | This is a new detection. |

Jul 14, 2026
1. ### [WAF Release - Scheduled changes for 2026-07-20](https://edgetunnel-b2h.pages.dev/changelog/post/scheduled-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  

| Announcement Date | Release Date | Release Behavior | Legacy Rule ID | Rule ID     | Description                                                        | Comments                 |
| ----------------- | ------------ | ---------------- | -------------- | ----------- | ------------------------------------------------------------------ | ------------------------ |
| 2026-07-12        | 2026-07-20   | Log              | N/A            | ...215e7d31 | SSRF - Restricted Protocol                                         | This is a new detection. |
| 2026-07-12        | 2026-07-20   | Log              | N/A            | ...a935ee5d | SSRF - Obfuscated Host                                             | This is a new detection. |
| 2026-07-12        | 2026-07-20   | Log              | N/A            | ...1b0230ac | LFI - Path Traversal                                               | This is a new detection. |
| 2026-07-14        | 2026-07-20   | Log              | N/A            | ...61349c8b | Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276 | This is a new detection. |
| 2026-07-14        | 2026-07-20   | Log              | N/A            | ...9cb61eac | Adobe ColdFusion - Path Traversal - CVE:CVE-2026-48282             | This is a new detection. |
| 2026-07-14        | 2026-07-20   | Log              | N/A            | ...4ac5e21f | XSS — JS Bracket Concat Obfuscation - Body                         | This is a new detection. |
| 2026-07-14        | 2026-07-20   | Log              | N/A            | ...f31f5559 | XSS — JS Bracket Concat Obfuscation - Headers                      | This is a new detection. |
| 2026-07-14        | 2026-07-20   | Log              | N/A            | ...987984fd | XSS — JS Bracket Concat Obfuscation - URI                          | This is a new detection. |

Jul 13, 2026
1. ### [Precursor introduces session-based bot detection](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-13-precursor-session-based-detection/)  
[ Challenges ](https://edgetunnel-b2h.pages.dev/cloudflare-challenges/)  
Precursor is rolling out to all customers starting today. Precursor is client-side JavaScript that enables session-based bot detection.  
You can [read the announcement blog ↗](https://blog.cloudflare.com/introducing-precursor) for background on why we built Precursor and how session-level behavioral detection works.  
With Precursor enabled, Cloudflare can:

  * Continuously evaluate behavioral signals across a session
  * Re-validate challenge clearance as behavior changes
  * Update bot scores with session context
  * Provide client-side visibility where none previously existed  
It integrates with existing protections, including Security Rules, and can be enabled directly from the Cloudflare dashboard with configurable modes to balance security and user experience.  
![Animated walkthrough of enabling Precursor in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/images/precursor/enabling_precursor.gif)  
To learn more, refer to the [Precursor documentation](https://edgetunnel-b2h.pages.dev/cloudflare-challenges/precursor/).

Jul 09, 2026
1. ### [Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-09-tunnel-routes-and-connections-api-changes/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
On **October 5, 2026**, two changes take effect across the [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/) and [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/): the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the `connections` field. If you manage private network routes or read tunnel connection details through the API, `cloudflared`, Terraform, or another integration, review the changes in the following sections and migrate before the removal date.  
#### Route endpoints  
The CIDR-encoded route endpoints are deprecated in favor of the standard, `route_id`\-based endpoints that already exist today. Both sets of endpoints route a private network through [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) or [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) (the API still refers to Mesh nodes as `warp_connector`) — only the request shape changes.

**Deprecated endpoints (removed October 5, 2026):**

  * Create a tunnel route (CIDR Endpoint): [POST /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/create/)
  * Update a tunnel route (CIDR Endpoint): [PATCH /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/edit/)
  * Delete a tunnel route (CIDR Endpoint): [DELETE /accounts/{account\_id}/teamnet/routes/network/{ip\_network\_encoded}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/subresources/networks/methods/delete/)

**Replacement endpoints:**

  * Create a tunnel route: [POST /accounts/{account\_id}/teamnet/routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/create/)
  * Update a tunnel route: [PATCH /accounts/{account\_id}/teamnet/routes/{route\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/edit/)
  * Delete a tunnel route: [DELETE /accounts/{account\_id}/teamnet/routes/{route\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/delete/)  
#### What is changing

|                  | Deprecated (CIDR-encoded path)                                 | Replacement                                                         |
| ---------------- | -------------------------------------------------------------- | ------------------------------------------------------------------- |
| Route identifier | URL-encoded CIDR in the path (/network/{ip\_network\_encoded}) | route\_id in the path (network moves to the request body on create) |
| Create           | POST .../teamnet/routes/network/{ip\_network\_encoded}         | POST .../teamnet/routes with network and tunnel\_id in the body     |
| Update           | PATCH .../teamnet/routes/network/{ip\_network\_encoded}        | PATCH .../teamnet/routes/{route\_id}                                |
| Delete           | DELETE .../teamnet/routes/network/{ip\_network\_encoded}       | DELETE .../teamnet/routes/{route\_id}                               |  
#### Action required

  1. Capture each route's `route_id` by calling [List tunnel routes](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/subresources/routes/methods/list/), or read it from the response the first time you create a route with the replacement endpoint.
  2. Update any scripts, backend services, or CI/CD pipelines that call the CIDR-encoded endpoints directly.
  3. If you manage routes with the `cloudflared tunnel route ip add | delete` commands, upgrade `cloudflared` to the [latest version ↗](https://github.com/cloudflare/cloudflared/releases).
  4. If you manage routes with Terraform, make sure you are on a current version of the [cloudflare\_zero\_trust\_tunnel\_cloudflared\_route ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero%5Ftrust%5Ftunnel%5Fcloudflared%5Froute) resource and the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs).  
```bash  
# Before: create a route by URL-encoding the CIDR into the path  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/network/172.16.0.0%2F16 \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'  
# After: create a route with the network in the request body  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"network": "172.16.0.0/16", "tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}'  
# After: update or delete a route using its route_id  
curl -X PATCH https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H 'Content-Type: application/json' \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     -d '{"comment": "Updated comment for this route."}'  
curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
```  
#### Cloudflare Tunnel and Cloudflare Mesh connections  
Starting the same day, the `connections` array is removed from list and get responses for [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes (the `cfd_tunnel` and `warp_connector` API resources). Query the dedicated connections endpoint instead of reading the field off the tunnel or node object.  
This affects:

  * [GET /accounts/{account\_id}/cfd\_tunnel](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/list/) — `connections` removed from each item in `result`
  * [GET /accounts/{account\_id}/cfd\_tunnel/{tunnel\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/methods/get/) — `connections` removed from `result`
  * [GET /accounts/{account\_id}/warp\_connector](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/list/) — `connections` removed from each item in `result`
  * [GET /accounts/{account\_id}/warp\_connector/{tunnel\_id}](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/methods/get/) — `connections` removed from `result`  
#### Action required  
Fetch connection details from the tunnel-specific connections endpoint instead of parsing it off the list or get response. For Cloudflare Tunnel, call [GET /accounts/{account\_id}/cfd\_tunnel/{tunnel\_id}/connections](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/cloudflared/subresources/connections/methods/get/). For Cloudflare Mesh, call [GET /accounts/{account\_id}/warp\_connector/{tunnel\_id}/connections](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/subresources/warp%5Fconnector/subresources/connections/methods/get/).  
```bash  
# Before: read connections off the tunnel object  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
# After: query connections directly  
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \
     -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"  
```  
Update any dashboards, monitoring scripts, or automation that parses `connections` from the tunnel list or get response. `cloudflared` and the Cloudflare Terraform provider do not read this field, so no changes are required on their side for this part of the update.  
#### Why we are making these changes

  * **Smaller, faster responses.** Cloudflare Tunnel and Cloudflare Mesh nodes with many connections no longer inflate every list and get call — connection detail is only fetched when you need it.
  * **A single way to identify a route.** Consolidating on `route_id` removes the need to URL-encode CIDR ranges into the path and matches how every other resource in the Zero Trust Networks API is addressed.
  * **Consistency across the API.** Both changes align these endpoints with Cloudflare's standard REST conventions for resource identifiers and nested detail endpoints.  
To learn more, refer to the [Zero Trust Networks API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/networks/), the [Cloudflare Tunnel API](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/tunnels/), and [Routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/routes/) documentation.

Jul 01, 2026
1. ### [New options to manage AI traffic](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-ai-traffic-options/)  
[ Bots ](https://edgetunnel-b2h.pages.dev/bots/)  
Not all AI traffic is the same. Now, all customers — including those on the Free plan — can manage AI crawlers based on what they actually do on your site. Cloudflare groups AI traffic into three behaviors you can control independently: [Search, Agent, and Training](https://edgetunnel-b2h.pages.dev/bots/concepts/bot/#ai-bots). This lets you keep the automated traffic that sends readers and revenue back to you, while blocking the traffic that only takes from your content.  
Each behavior maps to a real use case. **Search** covers crawlers that index your content so they can answer questions about it later, where you should expect referral traffic or other equitable compensation in return. **Agent** covers automated activity acting in real time on a person's behalf, such as chat fetch bots and browser-use agents. **Training** covers crawlers that take your content to train or fine-tune a model. For each preset you can choose to block on all pages, block only on pages that display ads, or choose not to block.  
![The Configure AI bot traffic policies screen, where Search, Agent, and Training can each be set to allow, block, or block only on pages with ads](https://edgetunnel-b2h.pages.dev/_astro/ai-bot-traffic-policies.BqXU7Gmv_Z24E74g.webp)  
Starting **September 15, 2026**, new domains onboarding to Cloudflare receive updated defaults: Bots classified as Training or as Agent are blocked on pages that display ads, while **Search** remains allowed. On that date, multi-purpose crawlers that combine Search and Training will be affected by the new defaults to block Training. All customers can [opt out of the new defaults ↗](https://dash.cloudflare.com/?to=/:account/:zone/security/settings) at any time before September 15.

Jul 01, 2026
1. ### [More visibility into bot traffic with BotBase and Attribution Business Insights](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-botbase-attribution-business-insights/)  
[ Bots ](https://edgetunnel-b2h.pages.dev/bots/)  
With Content Independence Day 2026, [Enterprise Bot Management](https://edgetunnel-b2h.pages.dev/bots/get-started/bot-management/) customers get two new tools that make bot traffic far easier to see and reason about: [BotBase](https://edgetunnel-b2h.pages.dev/bots/botbase/), a searchable directory of every bot Cloudflare tracks, and [Attribution Business Insights](https://edgetunnel-b2h.pages.dev/bots/attribution-business-insights/), a dashboard that shows how much value each crawler sends back to your business.  
BotBase is Cloudflare's directory of all known bots and agents, available directly in the dashboard. It shows how Cloudflare classifies each bot by behavior — Search, Agent, Training, and other categories such as Transact, Data Collection, SEO, and Ads Verification — so you can understand why a given crawler is visiting you. You can search and filter the full catalogue, filter your own traffic down to a single bot to investigate its activity on your zone, and copy any bot's detection ID to target it precisely in [Security rules](https://edgetunnel-b2h.pages.dev/security/rules/). Every tracked bot in BotBase is also published in [Cloudflare Radar's bots and agents directory ↗](https://radar.cloudflare.com/bots/directory).  
Attribution Business Insights is built for content owners and business decision-makers who want to know which bots help or harm their business, without reading rule syntax. The dashboard reports crawl-to-referral ratios both site-wide and per bot operator — comparing how often a company crawls your content against how many visitors it actually refers back — over the last 24 hours, 7 days, or 30 days. Each operator is labeled with Cloudflare's [updated classification](https://edgetunnel-b2h.pages.dev/bots/concepts/bot/verified-bots/) and an action status of Allowed, Blocked, or Partially blocked, giving stakeholders a shared, at-a-glance view of the AI traffic reaching your site.  
![The Attribution Business Insights dashboard, showing bot traffic, content page requests, crawl-to-referral ratio, and a per-operator bot activity table](https://edgetunnel-b2h.pages.dev/_astro/attribution-business-insights.Cu-ZtxkX_1SkuMS.webp)

Jul 01, 2026
1. ### [WAF Release - 2026-07-01](https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-01-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This release adds targeted coverage for a path traversal flaw in Fortinet FortiSandbox (CVE-2026-39813) and transitions the Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule action from Block to Disabled.

**Key Findings**

  * CVE-2026-39813: A path traversal vulnerability in Fortinet FortiSandbox allows remote, unauthenticated attackers to read arbitrary files from the underlying filesystem due to insufficient validation of user-supplied input paths.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                 | Previous Action | New Action | Comments                                                        |
| -------------------------- | ----------- | -------------- | ----------------------------------------------------------- | --------------- | ---------- | --------------------------------------------------------------- |
| Cloudflare Managed Ruleset | ...d84c92c9 | N/A            | Fortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813 | Log             | Block      | This is a new detection.                                        |
| Cloudflare Managed Ruleset | ...c12cf9c8 | N/A            | Anomaly:Header:User-Agent - Fake Bing or MSN Bot            | Enabled         | Disabled   | We are changing the action for this rule from BLOCK to Disabled |

Jun 23, 2026
1. ### [Regionalized IP Bindings for Regional Services](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-23-regionalized-ip-bindings/)  
[ Data Localization Suite ](https://edgetunnel-b2h.pages.dev/data-localization/)  
Regional Services now supports **Regionalized IP Bindings**, letting you regionalize traffic at the IP layer for prefixes you bring to Cloudflare through [Bring Your Own IP (BYOIP)](https://edgetunnel-b2h.pages.dev/byoip/).  
Where [Regional Hostnames](https://edgetunnel-b2h.pages.dev/data-localization/regional-services/regional-hostnames/) regionalize traffic by hostname, Regionalized IP Bindings let you bind a CIDR from one of your prefixes to a region — ideal for address-map deployments and any service you address by IP rather than hostname. Cloudflare then terminates TLS and processes traffic to those addresses only within the data centers in that region.  
Regionalized IP Bindings requires the Regional Services and Regional Services for BYOIP entitlements. Contact your account team to enable them.  
To get started, refer to [Regionalized IP Bindings](https://edgetunnel-b2h.pages.dev/data-localization/regional-services/ip-bindings/).

Jun 23, 2026
1. ### [WAF Release - 2026-06-23](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-23-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This week's release introduces new managed protection to address a critical pre-authentication OS command injection vulnerability in Ivanti Sentry (CVE-2026-10520).

**Key Findings**

  * CVE-2026-10520: An OS command injection vulnerability in Ivanti Sentry allows remote, unauthenticated attackers to execute arbitrary system commands with root privileges. The flaw stems from improper sanitization of input strings parsed during internal configuration handling.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                            | Previous Action | New Action | Comments                 |
| -------------------------- | ----------- | -------------- | ------------------------------------------------------ | --------------- | ---------- | ------------------------ |
| Cloudflare Managed Ruleset | ...242fdf83 | N/A            | Ivanti Sentry - Command Injection - CVE:CVE-2026-10520 | Log             | Block      | This is a new detection. |

Jun 19, 2026
1. ### [Manage all your routes from one page in the dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-19-unified-routes-page/)  
[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)  
The **Routes** page in the Cloudflare dashboard now shows the routes across all of your connectors — [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) and [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) routes alongside [Cloudflare WAN](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) and [Magic Transit](https://edgetunnel-b2h.pages.dev/magic-transit/) static routes — in a single table, instead of a separate routes view per product.  
![The unified Routes page in the Cloudflare dashboard, showing routes across connectors in a single table](https://edgetunnel-b2h.pages.dev/_astro/2026-06-19-unified-routes.B3igBY20_Z1awHp.webp)  
From the unified Routes page you can:

  * **Visualize your network with an interactive map** that shows how your destinations flow through to your connectors — including equal-cost multi-path (ECMP) routes where the same prefix is served by several connectors. Select a node to filter the table down to the routes behind it.
  * **See every route in one table**, with its destination, type, connector, priority, and source, and filter or sort to find what you need.
  * **Create, edit, and delete routes** of any supported type without leaving the page. When adding a Cloudflare WAN or Magic Transit static route, you now pick the next hop by **connector name** instead of typing its IP.
  * **Manage [virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/virtual-networks/)** from a dedicated tab.
  * **Test a route** to see which connector and next hop a destination resolves to before you commit a change.  
To find it, go to **Networking** \> **Routes** in the dashboard sidebar.  
[ Go to **Routes** ](https://dash.cloudflare.com/?to=/:account/magic-networks/routes)  
Your existing routes, APIs, and configurations are unchanged — this is a dashboard experience that brings them together in one place. Learn how to [add routes](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/routes/add-routes/) and [manage virtual networks](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/virtual-networks/).

Jun 17, 2026
1. ### [Post-quantum ML-DSA certificates for Authenticated Origin Pulls and Custom Origin Trust Store](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-17-pqc-mldsa-aop-cots/)  
[ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/)  
Cloudflare now accepts [ML-DSA ↗](https://csrc.nist.gov/pubs/fips/204/final) (FIPS 204) post-quantum certificates on the connection between Cloudflare's edge and your origin server. Combined with our existing [X25519MLKEM768](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/#hybrid-key-agreement) key agreement, this lets you establish end-to-end post-quantum authentication on the Cloudflare-to-origin connection.  
ML-DSA is supported in two origin-facing features:

  * [Authenticated Origin Pulls](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/) (AOP) — upload an ML-DSA client certificate that Cloudflare will present during the mTLS handshake to your origin. Available at both zone-level and per-hostname scopes.
  * [Custom Origin Trust Store](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/custom-origin-trust-store/) (COTS) — upload an ML-DSA certificate authority that Cloudflare will trust when validating your origin server certificate under [Full (strict) encryption mode](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/ssl-modes/full-strict/).  
Refer to [Post-quantum signatures](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/pqc-to-origin/#post-quantum-signatures) for certificate generation and setup guidance, and to [PQC in Cloudflare products](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/pqc-cloudflare-products/) for the current post-quantum deployment status across Cloudflare.

Jun 15, 2026
1. ### [Use Cloudforce One threat intelligence in WAF rules](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-15-threat-intelligence-fields/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
You can now match incoming requests against Cloudforce One threat intelligence in your WAF rules. A new detection looks up the client IP address of each request against the threat intelligence database. If the IP was involved in threat activity in the past seven days, Cloudflare populates `cf.intel.ip.*` fields that you can use in [custom rules](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) and [rate limiting rules](https://edgetunnel-b2h.pages.dev/waf/rate-limiting-rules/).  
The detection populates the following fields. Use the [any()](https://edgetunnel-b2h.pages.dev/ruleset-engine/rules-language/functions/#any) function with the `[*]` wildcard to match array values:

  * `cf.intel.ip.datasets` — the dataset that flagged the IP address (`ddos` or `waf`).
  * `cf.intel.ip.target_industries` — industries the IP address has targeted.
  * `cf.intel.ip.attacker_names` — known threat actors associated with the IP address.
  * `cf.intel.ip.attacker_countries` — source countries of the threat activity.
  * `cf.intel.ip.target_countries` — countries the IP address has targeted.  
For example, the following custom rule expression blocks requests from IP addresses associated with DDoS activity that have targeted France:  
```txt  
any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")  
```  
These fields work with the Cloudflare API and Terraform. Matches are logged in [Security Analytics](https://edgetunnel-b2h.pages.dev/waf/analytics/security-analytics/).  
The threat intelligence detection is available to customers with an active [Cloudforce One](https://edgetunnel-b2h.pages.dev/security-center/cloudforce-one/) subscription. For more information, refer to [Threat intelligence](https://edgetunnel-b2h.pages.dev/waf/detections/threat-intelligence/).

Jun 15, 2026
1. ### [WAF Release - 2026-06-15](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-15-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic. These rules protect affected installations from unauthorized data exfiltration at the network edge.

**Key Findings**

  * CVE-2026-26980: A blind SQL injection vulnerability in the Ghost CMS Content API (versions 3.24.0 to 6.19.0) allows unauthenticated remote attackers to inject malicious SQL commands via query parameters due to improper input validation.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                           | Previous Action | New Action | Comments                 |
| -------------------------- | ----------- | -------------- | ------------------------------------- | --------------- | ---------- | ------------------------ |
| Cloudflare Managed Ruleset | ...b4c29bc6 | N/A            | Ghost CMS - SQLi - CVE:CVE-2026-26980 | Log             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...b56f403f | N/A            | SQLi - Obfuscated Boolean - URI       | Log             | Disabled   | This is a new detection. |

Jun 10, 2026
1. ### [Automated Cease and Desist templates for Brand Protection](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-08-brand-protection-cease-and-desist-letters/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  

**TL;DR:** Brand Protection now features an **Automated Cease & Desist (C&D)** workflow. When you discover an infringing domain hosted outside of Cloudflare, you can instantly generate, review, and download a custom-branded, pre-filled legal notice in seconds.  
#### Why this matters  
This update introduces a major shift from pure detection to actionable enforcement, eliminating the manual burden for your Trust & Safety and Legal teams:

  * **Instant WHOIS and Recipient Lookup:** We automatically scrape registrar data and WHOIS contact information (such as the registrant or registrar abuse email) behind the scenes, highlighting exactly where your notice needs to be sent
  * **Smart Template Automation:** We pre-fill your custom-branded templates with essential metadata, including the infringing domain, registrar name, and discovery date.
  * **Tailored Enforcement Tones:** Choose from three default layout strategies depending on the severity of the infrastructure match:  
    * _Exact Match:_ A formal demand for identical trademark infringements
    * _Similar Match:_ A standard notice optimized for typosquatting (one-character distance matches)
    * _Friendly Tone:_ An amicable initial outreach for potential unintentional or accidental infringements
  * **Full Editing Control:** Before creating the final PDF, a real-time review screen allows you to fine-tune the messaging, modify placeholders, and ensure your text aligns perfectly with internal legal standards  
#### How it works  
When reviewing a malicious domain match inside your dashboard, your enforcement path splits depending on where the attacker is located:

  1. **On the Cloudflare Network:** If the domain uses Cloudflare’s network or registrar, trigger our existing integrated abuse reporting flow with one click.
  2. **Hosted Elsewhere:** If the domain is hosted on an external provider, click the **Generate C&D Letter** option to launch the new document builder, pick your template, verify the auto-populated recipient data, and download your finalized PDF.  
You can manage your templates and enforce matches by going to the **Cloudflare Dashboard > Application Security > Brand Protection** and selecting your detected Brand Protection matches. For more information, read the [Brand Protection documentation](https://edgetunnel-b2h.pages.dev/security-center/brand-protection/).  
> **Note:** Cloudflare does not represent you and cannot provide you with legal advice. Only you can decide whether your rights have been infringed, whether a cease and desist letter is appropriate, and what that letter should say.

Jun 09, 2026
1. ### [WAF Release - 2026-06-09](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-09-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This release introduces new detections for a critical SQL injection vulnerability in Drupal installations utilizing PostgreSQL (CVE-2026-9082), alongside targeted protection for an unsafe deserialization flaw in the Mirasvit Cache Warmer extension (CVE-2026-45247). Additionally, this release includes coverage for a prototype pollution vector in Axios (CVE-2026-40175) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic.

**Key Findings**

  * CVE-2026-9082: A database abstraction vulnerability affects Drupal sites configured with a PostgreSQL backend. Remote, unauthenticated attackers can exploit this flaw via crafted inputs to inject malicious SQL commands and access or manipulate backend data.
  * CVE-2026-45247: A PHP Object Injection vulnerability exists in the Mirasvit Cache Warmer extension for Magento and Adobe Commerce. This flaw stems from unsafe deserialization of untrusted user input, enabling unauthenticated attackers to execute arbitrary code on the hosting server.
  * CVE-2026-40175: A prototype pollution vulnerability affects the Axios HTTP client library. Attackers can exploit this to inject malicious properties into the global JavaScript object prototype, potentially causing application crashes (Denial of Service) or executing unauthorized code depending on the application structure.

**Impact**  
Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate database contents, or induce application crashes, leading to severe operational disruption or complete server compromise. These newly deployed signatures intercept these advanced malicious payloads at the edge before they can interact with vulnerable software configurations.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                       | Previous Action | New Action | Comments                 |
| -------------------------- | ----------- | -------------- | ----------------------------------------------------------------- | --------------- | ---------- | ------------------------ |
| Cloudflare Managed Ruleset | ...387cf935 | N/A            | Axios - Prototype Pollution - CVE:CVE-2026-40175                  | Log             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...417eb9e0 | N/A            | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - Body               | Log             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...fd3857fd | N/A            | Drupal - PostgreSQL SQLi - CVE:CVE-2026-9082 - URI                | Log             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...aee241d2 | N/A            | SQLi - Obfuscated Boolean - Body                                  | N/A             | Disabled   | This is a new detection. |
| Cloudflare Managed Ruleset | ...d8620070 | N/A            | SQLi - Obfuscated Boolean - Headers                               | N/A             | Disabled   | This is a new detection. |
| Cloudflare Managed Ruleset | ...e0be4d47 | N/A            | Mirasvit Cache Warmer - PHP Object Injection - CVE:CVE-2026-45247 | N/A             | Block      | This is a new detection. |

Jun 08, 2026
1. ### [Create WAF rules directly from Threat Events saved views](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-08-create-waf-rules-from-threat-events/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  
Cloudforce One users can now turn [Threat Events indicators](https://edgetunnel-b2h.pages.dev/security-center/cloudforce-one/#analyze-threat-events) into active defense. With this update, users can instantly generate a WAF rule that matches the dynamic list of IP addresses returned by any of their **Saved Views**.  
#### Why this matters  
Threat intelligence is most effective when it is immediately actionable. Previously, blocking threat actors required manually extracting indicators from threat events and copying them into your firewall rules. This new integration bridges the gap between threat discovery and threat mitigation:

  * When you identify an active threat pattern - such as an ongoing campaign targeting a specific industry, or using a known indicator type - you can pivot from investigation to mitigation in a single click.
  * Instead of writing complex, static IP rules, this functionality allows you to leverage the specific filtering logic you have already defined and saved within your Threat Events ecosystem.
  * Automating the generation of the WAF rule expression from your threat views eliminates manual copying errors, ensuring that the right malicious infrastructure is blocked instantly.  
#### How to use it  
You can implement these rules through both the dashboard UI and via the API / Terraform.  
Go to **Cloudflare Dashboard** \> **Application Security** \> **Threat Intelligence** \> **Manage Views**, select your desired view, and select **Create WAF Rule**.  
This will automatically pre-populate the [WAF rule builder](https://edgetunnel-b2h.pages.dev/firewall/cf-dashboard/create-edit-delete-rules/) with the matching threat event IP indicators.  
You can also automate this workflow by utilizing the [**WAF Rule Builder API**](https://edgetunnel-b2h.pages.dev/firewall/api/cf-firewall-rules/) alongside your [Threat Events saved views endpoints](https://edgetunnel-b2h.pages.dev/firewall/api/cf-firewall-rules/).

Jun 08, 2026
1. ### [Introducing Threat Actor Profiles in Threat Events](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-08-threat-actor-profiles/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  

**TL;DR:** We’ve launched **Threat Actor Profiles** directly inside the Threat Events dashboard. You can now immediately pivot from a generic alert or blocked event to a profile that unmasks the "Who, Why, and How" behind a threat event.  
#### Why this matters  
Security teams often suffer from a visibility gap. When an attack is blocked, it's difficult to know if it was a random automated bot or a sophisticated advanced persistent threat (APT) campaign specifically targeting your industry. Finding out usually means leaving your security dashboard to hunt through external OSINT feeds or static, out-of-date threat reports. Threat Actor Profiles solve this by sharing Cloudforce One’s deep adversary research directly inside your workflow:

  * Cloudflare sees the traffic in real-time across approximately 20% of the web. This means actor profiles display active malicious infrastructure the moment it touches our global edge.
  * Every profile provides clear strategic and tactical modules including alternative aliases, origin tracking, historical threat event volume, and MITRE ATT&CK mapping detailing the adversary's technical methods.
  * You can search the dedicated threat actor directory or click an actor's name inside any threat event to view all details and related events to the specific threat actor.  
#### How to use it  
Adversary tracking is now available in the Cloudflare Dashbboard and ready to be included in your daily investigation workflow:

  * Click on the **Threat Actor** name in the Threat Events table to open their full identity profile and review their aliases and attack stats.
  * Navigate to **Cloudflare Dashboard > Application Security > Threat Intelligence** to explore the new **Threat Actors** tab. Here, you can browse a card-based directory of all established entities tracked by Cloudforce One.  
Learn more in the [Cloudforce One documentation ↗](https://edgetunnel-b2h.pages.dev/security-center/cloudforce-one/#identify-the-adversary).

May 29, 2026
1. ### [Security scans more frequent](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-29-security-insights-default-scans/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  
Security Insights scans now run more often. Cloudflare scans Free accounts **every 7 days**, Pro and Business accounts **every 3 days**, and Enterprise accounts **daily**.  
In addition, all accounts and zones now receive scans by default. You no longer need to enable scans before Cloudflare checks your account for misconfigurations, vulnerabilities, and other security risks.  
Granular on-demand scans are now available on any plan. You can trigger an on-demand scan for any zone, insight, insight type from the Cloudflare dashboard in order to quickly re-check your security posture after remediating an issue.  
To learn more, refer to the [Security Insights documentation](https://edgetunnel-b2h.pages.dev/security/security-insights/).

May 27, 2026
1. ### [Cloudflare Tunnel now runs connectivity pre-checks at startup](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-27-cloudflared-connectivity-prechecks/)  
[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)  
Starting with [cloudflared version 2026.5.2 ↗](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) automates the entire [connectivity pre-checks workflow](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked.  
![cloudflared connectivity pre-checks output](https://edgetunnel-b2h.pages.dev/_astro/cloudflared-connectivity-prechecks.DRwN6tGe_c1XGu.webp)  
On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks:

  * **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs.
  * **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`.
  * **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates.  
Results are printed in a scannable CLI table with three states:

  * ✅ **Pass** — the check succeeded.
  * ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up.
  * ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`).  
If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors.  
Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide.  
To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/).

May 21, 2026
1. ### [Granular permissions for Cloudflare Tunnel and Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-21-tunnel-mesh-granular-permissions/)  
[ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/)[ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Mesh ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/)  
You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.  
#### What is new  
When you [add a member](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/manage/) or create a [permission policy](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/) instances and [Cloudflare Mesh](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-mesh/) nodes as scopable resource types. You can:

  * Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
  * Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
  * Scope a single policy to one or many Tunnels and Mesh nodes at once.  
#### How it works  
Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

  * **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
  * **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource.
  * **Resource enumeration is authorization-aware.** Listing endpoints (`GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to.  
#### Get started

  * Configure [granular permissions for Cloudflare Tunnel](https://edgetunnel-b2h.pages.dev/tunnel/advanced/granular-permissions/).
  * Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/granular-permissions/).
  * Review the [resource-scoped roles](https://edgetunnel-b2h.pages.dev/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference.

May 20, 2026
1. ### [WAF Release - 2026-05-20](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-20-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  

**Key Findings**

  * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

**Continuous Rule Improvements**  
We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                          | Previous Action | New Action | Comments                                                                                                          |
| -------------------------- | ----------- | -------------- | ---------------------------------------------------- | --------------- | ---------- | ----------------------------------------------------------------------------------------------------------------- |
| Cloudflare Managed Ruleset | ...9e9c068d | N/A            | Sitecore - Cache Poisoning - CVE:CVE-2025-53693 Beta | N/A             | Block      | This rule is merged into the original rule "Sitecore - Cache Poisoning - CVE:CVE-2025-53693" (ID: ...7c5b669c  ). |

May 15, 2026
1. ### [WAF Release - 2026-05-15 - Emergency](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-15-emergency-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  
This emergency release introduces two new rules to detect nginx heap buffer overflow and heap spray exploitation attempts targeting the rewrite module's `is_args` stale-state bug (CVE-2026-42945).

**Key Findings**  
CVE-2026-42945: nginx Heap Buffer Overflow via Stale `is_args` in Rewrite Module  
Successful exploitation allows remote attackers to trigger a heap buffer overflow in nginx's rewrite module by sending crafted URIs containing escapable characters. A length/copy pass mismatch in `ngx_http_script_copy_capture_code()` causes the copy pass to write escaped data into an undersized buffer, leading to heap corruption. This enables denial of service (worker process crash) and, with heap feng shui techniques, potential remote code execution.  
We strongly recommend upgrading to nginx 1.30.1 (or later) immediately to address the underlying vulnerability. If you cannot upgrade immediately, avoid `rewrite` directives with `?` in the replacement string followed by `set` or `if` referencing capture groups.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                          | Previous Action | New Action | Comments                 |
| -------------------------- | ----------- | -------------- | -------------------------------------------------------------------- | --------------- | ---------- | ------------------------ |
| Cloudflare Managed Ruleset | ...7e52be73 | N/A            | nginx - Remote Code Execution - Buffer Overread - CVE:CVE-2026-42945 | N/A             | Block      | This is a new detection. |
| Cloudflare Managed Ruleset | ...9df0ee6c | N/A            | nginx - Remote Code Execution - Heap Spray - CVE:CVE-2026-42945      | N/A             | Block      | This is a new detection. |

May 12, 2026
1. ### [Agent Readiness scores now available in URL Scanner via the Cloudflare Dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-12-url-scanner-report-agent-readiness/)  
[ Security Center ](https://edgetunnel-b2h.pages.dev/security-center/)  
We’ve added a new **Agent Readiness** tab to URL Scanner reports accessible via the Cloudflare dashboard. This feature evaluates your site against emerging AI standards and provides six specialized scores to help you optimize for the next generation of AI agents and automated discovery.  
The Internet is shifting from a human-read web to a machine-read web. AI agents now browse, interact with, and even perform transactions on websites. If a site isn't "agent-ready," these bots may consume excessive bandwidth, fail to find critical information, or be unable to navigate your services efficiently.  
This update provides material value by breaking down readiness into six actionable categories:

  * **Basic Web Presence**
  * **Discoverability**
  * **Content Accessibility**
  * **Bot Access Control**
  * **Protocol Discovery**
  * **Commerce**  
#### Accessing the report  
You can view these scores for any scanned URL directly in the dashboard or via our API.

  * **Dashboard:** Go to **Protect & Connect > Application Security > Investigate**. After running a scan, select the **Agent Readiness** tab in the report.
  * **API:** Use the [URL Scanner API ↗](https://edgetunnel-b2h.pages.dev/radar/investigate/url-scanner/) to programmatically retrieve these scores for your infrastructure.  
To learn more about the methodology behind these scores, refer to the [blogpost ↗](https://blog.cloudflare.com/agent-readiness/).

May 11, 2026
1. ### [WAF Release - 2026-05-11](https://edgetunnel-b2h.pages.dev/changelog/post/2026-05-11-waf-release/)  
[ WAF ](https://edgetunnel-b2h.pages.dev/waf/)  

**Key Findings**

  * Existing rule enhancements have been deployed to improve detection resilience against broad classes of web attacks and strengthen behavioral coverage.

**Continuous Rule Improvements**  
We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.

| Ruleset                    | Rule ID     | Legacy Rule ID | Description                                                | Previous Action | New Action | Comments                                                                                                                                |
| -------------------------- | ----------- | -------------- | ---------------------------------------------------------- | --------------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Cloudflare Managed Ruleset | ...68b3c389 | N/A            | Remote Code Execution - Java Deserialization - Body - Beta | Block           | Disabled   | This is a new detection. This rule is merged into the original rule "Remote Code Execution - Java Deserialization" (ID: ...744305c4  ). |

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/application-security/#page","headline":"Application security Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/application-security/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```