Skip to content

Commit ad3efed

Browse files
ay-cfpedrosousa
ay-cf
and
pedrosousa
authored
Update WAF release note (#30166)
* Update WAF release note * Update 2026-04-21-waf-release.mdx updated <tr> * Update 2026-04-21-waf-release.mdx updated some rule's final action * Add empty line * Add space --------- Co-authored-by: Pedro Sousa <680496+pedrosousa@users.noreply.github.com>
1 parent dd6ab8b commit ad3efed

2 files changed

Lines changed: 644 additions & 86 deletions

File tree

‎src/content/changelog/waf/2026-04-21-waf-release.mdx‎

Lines changed: 347 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,347 @@
1+
---
2+
title: "WAF Release - 2026-04-21"
3+
description: Cloudflare WAF managed rulesets 2026-04-21 release
4+
date: 2026-04-21
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
This week's release introduces a new detection for a Remote Code Execution (RCE) vulnerability in Apache ActiveMQ (CVE-2026-34197) and an updated signature for Magento 2 - Unrestricted File Upload. Alongside these detections, we are continuing our work on rule refinements to provide deeper security insights for our customers.
10+
11+
**Key Findings**
12+
13+
- Apache ActiveMQ (CVE-2026-34197): A vulnerability in Apache ActiveMQ allows an unauthenticated, remote attacker to execute arbitrary code. This flaw occurs during the processing of specially crafted network packets, leading to potential full system compromise.
14+
15+
- Magento 2 - Unrestricted File Upload - 2: This is a follow-up enhancement to our existing protections for Magento and Adobe Commerce.
16+
17+
**Impact**
18+
19+
Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain full administrative control over affected servers. We strongly recommend applying official vendor patches for Apache ActiveMQ and Magento to address the underlying vulnerabilities.
20+
21+
**Continuous Rule Improvements**
22+
23+
We are continuously refining our managed rules to provide more resilient protection and deeper insights into attack patterns. To ensure an optimal security posture, we recommend consistently monitoring the Security Events dashboard and adjusting rule actions as these enhancements are deployed.
24+
25+
<table style="width: 100%">
26+
<thead>
27+
<tr>
28+
<th>Ruleset</th>
29+
<th>Rule ID</th>
30+
<th>Legacy Rule ID</th>
31+
<th>Description</th>
32+
<th>Previous Action</th>
33+
<th>New Action</th>
34+
<th>Comments</th>
35+
</tr>
36+
</thead>
37+
<tbody>
38+
<tr>
39+
<td>Cloudflare Managed Ruleset</td>
40+
<td>
41+
<RuleID id="ff8df24181aa4573a81be531ee159e2e" />
42+
</td>
43+
<td>N/A</td>
44+
<td>Command Injection - Generic 8 - uri</td>
45+
<td>Log</td>
46+
<td>Block</td>
47+
<td>This is a new detection. Previous description was "Command Injection - Generic 8 - uri - Beta"</td>
48+
</tr>
49+
<tr>
50+
<td>Cloudflare Managed Ruleset</td>
51+
<td>
52+
<RuleID id="9429b63c137247faadeb8a29a15308cf" />
53+
</td>
54+
<td>N/A</td>
55+
<td>Command Injection - Generic 8 - body</td>
56+
<td>Disabled</td>
57+
<td>Disabled</td>
58+
<td>
59+
Rule metadata description refined. Previous description was
60+
"Command Injection - Generic 8" (ID:{" "}
61+
<RuleID id="5b3ce84c099040c6a25cee2d413592e2" />)
62+
</td>
63+
</tr>
64+
<tr>
65+
<td>Cloudflare Managed Ruleset</td>
66+
<td>
67+
<RuleID id="9429b63c137247faadeb8a29a15308cf" />
68+
</td>
69+
<td>N/A</td>
70+
<td>Command Injection - Generic 8 - body - Beta</td>
71+
<td>Disabled</td>
72+
<td>Disabled</td>
73+
<td>
74+
This is a new detection. This rule is merged into the original rule
75+
"Command Injection - Generic 8 - body" (ID:{" "}
76+
<RuleID id="5b3ce84c099040c6a25cee2d413592e2" />)
77+
</td>
78+
</tr>
79+
<tr>
80+
<td>Cloudflare Managed Ruleset</td>
81+
<td>
82+
<RuleID id="8629bb58defe4193ab4d493c7bd2d8fa" />
83+
</td>
84+
<td>N/A</td>
85+
<td>MySQL - SQLi - Executable Comment - Body</td>
86+
<td>Block</td>
87+
<td>Block</td>
88+
<td>
89+
Rule metadata description refined. Previous description was
90+
"MySQL - SQLi - Executable Comment" (ID:{" "}
91+
<RuleID id="8629bb58defe4193ab4d493c7bd2d8fa" />)
92+
</td>
93+
</tr>
94+
<tr>
95+
<td>Cloudflare Managed Ruleset</td>
96+
<td>
97+
<RuleID id="85aaf5db9e0c4237b87e837e958047ed" />
98+
</td>
99+
<td>N/A</td>
100+
<td>MySQL - SQLi - Executable Comment - Beta</td>
101+
<td>Log</td>
102+
<td>Block</td>
103+
<td>
104+
This is a new detection. This rule is merged into the original rule
105+
"MySQL - SQLi - Executable Comment - Body" (ID:{" "}
106+
<RuleID id="8629bb58defe4193ab4d493c7bd2d8fa" />)
107+
</td>
108+
</tr>
109+
<tr>
110+
<td>Cloudflare Managed Ruleset</td>
111+
<td>
112+
<RuleID id="d19cd574c4644952881a6f3a582cc559" />
113+
</td>
114+
<td>N/A</td>
115+
<td>MySQL - SQLi - Executable Comment - Headers</td>
116+
<td>Log</td>
117+
<td>Block</td>
118+
<td>
119+
This is a new detection.
120+
</td>
121+
</tr>
122+
<tr>
123+
<td>Cloudflare Managed Ruleset</td>
124+
<td>
125+
<RuleID id="407f9ec8a17348dfba3b9450a16639d3" />
126+
</td>
127+
<td>N/A</td>
128+
<td>MySQL - SQLi - Executable Comment - URI</td>
129+
<td>Log</td>
130+
<td>Block</td>
131+
<td>
132+
This is a new detection.
133+
</td>
134+
</tr>
135+
<tr>
136+
<td>Cloudflare Managed Ruleset</td>
137+
<td>
138+
<RuleID id="d07e6dbf15664b99b37b0d2544f24211" />
139+
</td>
140+
<td>N/A</td>
141+
<td>Magento 2 - Unrestricted file upload - 2</td>
142+
<td>Log</td>
143+
<td>Block</td>
144+
<td>
145+
This is a new detection.
146+
</td>
147+
</tr>
148+
<tr>
149+
<td>Cloudflare Managed Ruleset</td>
150+
<td>
151+
<RuleID id="26ef21cb197b44fc8a98b7cebf170a17" />
152+
</td>
153+
<td>N/A</td>
154+
<td>Apache ActiveMQ - Remote Code Execution - CVE:CVE-2026-34197</td>
155+
<td>Log</td>
156+
<td>Block</td>
157+
<td>
158+
This is a new detection.
159+
</td>
160+
</tr>
161+
<tr>
162+
<td>Cloudflare Managed Ruleset</td>
163+
<td>
164+
<RuleID id="7f7bc3d28a8e43bf97bd15d68c2ac1a7" />
165+
</td>
166+
<td>N/A</td>
167+
<td>SQLi - Sleep Function - Beta</td>
168+
<td>Log</td>
169+
<td>Block</td>
170+
<td>
171+
This is a new detection. This rule is merged into the original rule
172+
"SQLi - Sleep Function" (ID:{" "}
173+
<RuleID id="2c333735f7b24566b17cb64ef77e8d54" />)
174+
</td>
175+
</tr>
176+
<tr>
177+
<td>Cloudflare Managed Ruleset</td>
178+
<td>
179+
<RuleID id="3872e5638bdf4bf0943a80394dacaeb8" />
180+
</td>
181+
<td>N/A</td>
182+
<td>SQLi - Sleep Function - Headers</td>
183+
<td>Log</td>
184+
<td>Block</td>
185+
<td>
186+
This is a new detection.
187+
</td>
188+
</tr>
189+
<tr>
190+
<td>Cloudflare Managed Ruleset</td>
191+
<td>
192+
<RuleID id="bebce8fadfa94ccab09eb74fed4c9ece" />
193+
</td>
194+
<td>N/A</td>
195+
<td>SQLi - Sleep Function - URI</td>
196+
<td>Log</td>
197+
<td>Block</td>
198+
<td>
199+
This is a new detection.
200+
</td>
201+
</tr>
202+
<tr>
203+
<td>Cloudflare Managed Ruleset</td>
204+
<td>
205+
<RuleID id="7a40eed5a8654a50a2598a821dfa64df" />
206+
</td>
207+
<td>N/A</td>
208+
<td>SQLi - Probing - uri</td>
209+
<td>Log</td>
210+
<td>Block</td>
211+
<td>
212+
This is a new detection.
213+
</td>
214+
</tr>
215+
<tr>
216+
<td>Cloudflare Managed Ruleset</td>
217+
<td>
218+
<RuleID id="15c6b2ce033949b2a1a9f9454c62e2e7" />
219+
</td>
220+
<td>N/A</td>
221+
<td>SQLi - Probing - header</td>
222+
<td>Log</td>
223+
<td>Block</td>
224+
<td>
225+
This is a new detection.
226+
</td>
227+
</tr>
228+
<tr>
229+
<td>Cloudflare Managed Ruleset</td>
230+
<td>
231+
<RuleID id="fc9d800b7a724181af8d5650aab28ea1" />
232+
</td>
233+
<td>N/A</td>
234+
<td>SQLi - Probing - body</td>
235+
<td>Disabled</td>
236+
<td>Disabled</td>
237+
<td>
238+
This is a new detection. This rule is merged into the original rule
239+
"SQLi - Probing" (ID: <RuleID id="2c20b5e8684043f48620ff77b4026c88" />)
240+
</td>
241+
</tr>
242+
<tr>
243+
<td>Cloudflare Managed Ruleset</td>
244+
<td>
245+
<RuleID id="945c5aa9f45141dd872d7ec920999be0" />
246+
</td>
247+
<td>N/A</td>
248+
<td>SQLi - Probing 2 </td>
249+
<td>Disabled</td>
250+
<td>Disabled</td>
251+
<td>
252+
This rule had duplicate detection logic and has been deprecated.
253+
</td>
254+
</tr>
255+
<tr>
256+
<td>Cloudflare Managed Ruleset</td>
257+
<td>
258+
<RuleID id="f1771273700342758e73cf16d7aa0008" />
259+
</td>
260+
<td>N/A</td>
261+
<td>SQLi - UNION in MSSQL - Body</td>
262+
<td>Disabled</td>
263+
<td>Disabled</td>
264+
<td>
265+
This rule has been renamed to differentiate from "SQLi - UNION in MSSQL" (ID: <RuleID id="ef7db598c7654c729d9db56fee5e35fd" />) and contains updated rule logic.
266+
</td>
267+
</tr>
268+
<tr>
269+
<td>Cloudflare Managed Ruleset</td>
270+
<td>
271+
<RuleID id="3ffd242b4ba242ca965022d3a67d8561" />
272+
</td>
273+
<td>N/A</td>
274+
<td>SQLi - UNION - 3</td>
275+
<td>Disabled</td>
276+
<td>Disabled</td>
277+
<td>
278+
This rule had duplicate detection logic and has been deprecated.
279+
</td>
280+
</tr>
281+
<tr>
282+
<td>Cloudflare Managed Ruleset</td>
283+
<td>
284+
<RuleID id="5e69d599ad634c81abe36a5f0af34bba" />
285+
</td>
286+
<td>N/A</td>
287+
<td>XSS, HTML Injection - Embed Tag - URI</td>
288+
<td>Disabled</td>
289+
<td>Disabled</td>
290+
<td>
291+
This is a new detection.
292+
</td>
293+
</tr>
294+
<tr>
295+
<td>Cloudflare Managed Ruleset</td>
296+
<td>
297+
<RuleID id="2635275641bf44d4bad6a2e170282f38" />
298+
</td>
299+
<td>N/A</td>
300+
<td>XSS, HTML Injection - Embed Tag - Headers</td>
301+
<td>Log</td>
302+
<td>Block</td>
303+
<td>
304+
This is a new detection.
305+
</td>
306+
</tr>
307+
<tr>
308+
<td>Cloudflare Managed Ruleset</td>
309+
<td>
310+
<RuleID id="b3d033ea9f364574b0a2ec4223f4d718" />
311+
</td>
312+
<td>N/A</td>
313+
<td>XSS, HTML Injection - IFrame Tag - Src and Srcdoc Attributes - Headers</td>
314+
<td>Log</td>
315+
<td>Disabled</td>
316+
<td>
317+
This is a new detection.
318+
</td>
319+
</tr>
320+
<tr>
321+
<td>Cloudflare Managed Ruleset</td>
322+
<td>
323+
<RuleID id="76c37816ef5c4997ab2080a36978def1" />
324+
</td>
325+
<td>N/A</td>
326+
<td>XSS, HTML Injection - Link Tag - Headers</td>
327+
<td>Log</td>
328+
<td>Disabled</td>
329+
<td>
330+
This is a new detection.
331+
</td>
332+
</tr>
333+
<tr>
334+
<td>Cloudflare Managed Ruleset</td>
335+
<td>
336+
<RuleID id="7d6757e8a28f4853a72b4ce6ebd81645" />
337+
</td>
338+
<td>N/A</td>
339+
<td>XSS, HTML Injection - Link Tag - URI</td>
340+
<td>Disabled</td>
341+
<td>Disabled</td>
342+
<td>
343+
This is a new detection.
344+
</td>
345+
</tr>
346+
</tbody>
347+
</table>

0 commit comments

Comments
 (0)