Application Security Updates & Release Notes

Leaked credentials detection now scans the Authorization request header for Basic Authentication credentials. Previously, the detection only inspected request bodies, query strings, and headers for well-known web applications or custom detection locations, which meant credentials sent through HTTP Basic Authentication were not covered by default.

This new default scan location decodes the Authorization: Basic <credentials> header and compares the extracted username and password against Cloudflare's database of leaked credentials, the same way as other default scan locations. Matches populate the existing leaked credentials fields, such as cf.waf.credential_check.password_leaked, and trigger the Exposed-Credential-Check managed transform header if configured, so you can reuse existing custom rules and rate limiting rules without changes.

This change was applied automatically for zones with leaked credentials detection enabled. No configuration changes are required.

For more information, refer to Leaked credentials detection.

Original source

This release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.

Key Findings

CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.

Impact

The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...3590a4ad

N/A

Wordpress - Remote Code Execution - CVE:CVE-2026-65640

Block

N/A

Rule metadata description refined. Detection unchanged.

Cloudflare Free Ruleset

...cfe1a93c

N/A

Wordpress - Remote Code Execution - CVE:CVE-2026-65640

Block

N/A

Rule metadata description refined. Detection unchanged.

Original source

Announcement Date

Release Date

Release Behavior

Legacy Rule ID

Rule ID

Description

Comments

2026-08-17

2026-08-24

Log

N/A

...1489d892

HTTP/2 Request Smuggling - Request Body Anomaly

This is a new detection.

2026-08-17

2026-08-24

Log

N/A

...20646260

XSS - JavaScript Event Handler Coercion - Headers

This is a new detection.

2026-08-17

2026-08-24

Log

N/A

...d706d517

XSS - JavaScript Event Handler Coercion - Body

This is a new detection.

2026-08-17

2026-08-24

Log

N/A

...660886c8

XSS - JavaScript Event Handler Coercion - URI

This is a new detection.

2026-08-17

2026-08-24

Log

N/A

...c293b926

XSS, HTML Injection - Script Tag - Beta

This rule will be merged into the original rule "XSS, HTML Injection - Script Tag" (ID: ...7b58420b).

Original source

This release introduces new protection for a remote code execution vulnerability in vBulletin and improves two existing detections.

Key Findings

A new detection provides protection against vBulletin CVE-2026-61511.

Two existing detections have been improved to strengthen coverage.

Impact

Successful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader compromise of the hosting environment. Administrators are strongly encouraged to apply vendor updates and recommended mitigations.

Ruleset

Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset ...94f3006b N/A vBulletin - Remote Code Execution - CVE:CVE-2026-61511 Log Block Cloudflare Managed Ruleset ...098b749e N/A Version Control - Information Disclosure - Beta Log Block Cloudflare Managed Ruleset ...d56225d8 N/A vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta Log Block Original source

Turnstile Spin is now generally available with three setup paths for creating a Turnstile widget and wiring canonical server-side siteverify into your existing backend. Start in the dashboard, with Wrangler, or from your AI coding agent. All three paths create the same widget. You can complete the integration by hand or have your agent embed the widget, wire siteverify, and validate it.

Server-side verification

Turnstile setup has two parts: embed the widget in your frontend, then call siteverify from your backend. Without the second part, the widget appears on the page but does not protect the request.

The skill includes insertion snippets for Next.js (App Router and Pages Router), Astro, SvelteKit, Hugo, and vanilla HTML. For other frameworks, the agent proposes a generic pattern and asks you to confirm it first.

The Turnstile dashboard flags existing widgets with no matching siteverify traffic. Select Fix with Spin to copy a prompt that guides your agent through wiring siteverify into your backend.

Before finishing, the agent runs a real Turnstile token through your protected endpoint, checks that it passes, then replays the token to confirm the endpoint rejects it on the second try. If a check fails, the agent stops and shows you where.

Run Spin

You can run Spin three ways:

• In the Turnstile dashboard, select Set up with Spin, enter your domains, then select Set up. Spin creates the widget and returns the sitekey, secret, and a prompt for your agent.
• From the Wrangler CLI, run wrangler turnstile widget create. Wrangler prints the sitekey and secret. You wire the frontend and siteverify by hand.
• From your AI coding agent, paste the Spin prompt into Claude Code, Cursor, Codex, OpenCode, or GitHub Copilot Chat. Your agent fetches the skill, creates the widget, then embeds it and wires siteverify.

To get started, refer to the Turnstile Spin documentation.

Original source

This release updates WordPress XSS rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify XSS2Shell (CVE-2026-64638). It also disables the Command Injection - Obfuscation rule.

Key Findings

CVE-2026-64638: A pre-authentication reflected cross-site scripting vulnerability affecting the WordPress login screen. Exploitation requires social engineering and explicit interaction by the target user. Under additional conditions, it may be escalated to remote code execution.

Impact

The WordPress changes update rule metadata only; detection behavior and actions remain unchanged.

Ruleset

• Rule ID
• Legacy Rule ID
• Description
• Previous Action
• New Action
• Comments

Cloudflare Managed Ruleset

• ...9c6dff1c
• N/A
• Wordpress - XSS - CVE:CVE-2026-64638
• Block
• N/A
• Rule metadata description refined. Detection unchanged.

Cloudflare Free Ruleset

• ...9ab5ed95
• N/A
• Wordpress - XSS - CVE:CVE-2026-64638
• Block
• N/A
• Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset

• ...761e7a4c
• N/A
• Command Injection - Obfuscation
• Block
• Disabled
• Detection logic has been deprecated

Original source

This release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.

Key Findings

CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.

CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.

Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...052b07cf

N/A

Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

...3a5b40d6

N/A

Rails - Arbitrary File Read & RCE - CVE:CVE-2026-66066

Block

Block

This was labeled as File Upload - RCE.

Cloudflare Managed Ruleset

...8242627b

N/A

SSRF - Local

Disabled

This detection has been removed.

Cloudflare Managed Ruleset

...743a63ec

N/A

SSRF - Local - 2 - Beta

Disabled

This detection has been removed.

Cloudflare Managed Ruleset

...c2e84e2d

N/A

SSRF - Cloud - Beta

Disabled

This detection has been removed.

Cloudflare Managed Ruleset

...ab8af26f

N/A

SSRF - Cloud - 2 - Beta

Disabled

This detection has been removed.

Cloudflare Managed Ruleset

...25ba9d7c

N/A

SSRF - Cloud

Disabled

Block

We are changing the action for this rule from Disabled to BLOCK

Cloudflare Managed Ruleset

...01a076eb

N/A

SSRF - Local - Beta

Disabled

This detection has been removed.

Original source

Announcement Date

Release Date

Release Behavior

Legacy Rule ID

Rule ID

Description

Comments

2026-08-04
2026-08-10
Log
N/A
...94f3006b
vBulletin - Remote Code Execution - CVE:CVE-2026-61511
This is a new detection.

2026-08-04
2026-08-10
Log
N/A
...098b749e
Version Control - Information Disclosure - Beta
This is a beta detection and will replace the action on original detection "Version Control - Information Disclosure" (ID: ...0550c529)

2026-08-04
2026-08-10
Log
N/A
...d56225d8
vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132 - Beta
This is a beta detection and will replace the action on original detection "vBulletin - Code Injection - Invalid image format - CVE:CVE-2019-17132" (ID: ...8fe9f1c7)

Original source

This release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Nuxt Server Island components and Alibaba Fastjson deserialization routines, alongside enhanced protections for cloud metadata Server-Side Request Forgery (SSRF) and obfuscated command injection attempts.

Key Findings

Nuxt Server Island - RCE(GHSA-9473-5f9j-94wq): An unauthenticated vulnerability in Nuxt Server Islands where remote attackers can supply arbitrary component names or props to endpoints. Manipulating these parameters allows unauthenticated component Remote Code Execution (RCE) on the server.

Alibaba Fastjson JSONType Remote Code Execution: A unauthenticated remote code execution vulnerability in Alibaba Fastjson (≤ 1.2.83) during JSON deserialization. Under default configurations, attackers can execute arbitrary system commands, bypassing traditional classpath and gadget-based defenses.

Generic Protections (SSRF & Command Injection): Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications, alongside new rules targeting obfuscated command injection patterns across request parameters.

Ruleset

Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset ...c2e84e2d N/A SSRF - Cloud - Beta Log Block Cloudflare Managed Ruleset ...761e7a4c N/A Command Injection - Obfuscation Log Block Cloudflare Managed Ruleset ...7347c892 N/A Alibaba Fastjson JSONType Remote Code Execution - Body Log Block Cloudflare Managed Ruleset ...8ec012ea N/A Nuxt Server Island - RCE N/A Block Cloudflare Managed Ruleset ...3590a4ad N/A Generic Rules - RCE N/A Block Cloudflare Managed Ruleset ...9c6dff1c N/A Generic Rules - XSS N/A Block Cloudflare Managed Ruleset ...3a5b40d6 N/A File Upload - RCE N/A Block Cloudflare Free Ruleset ...cfe1a93c N/A Generic Rules - RCE N/A Block Cloudflare Free Ruleset ...9ab5ed95 N/A Generic Rules - XSS N/A Block Cloudflare Free Ruleset ...1b7f9c67 N/A File Upload - RCE N/A Block Original source

This release introduces new rules for vulnerabilities in Adobe ColdFusion, Next.js, WordPress alongside updates to existing rules thereby providing enhanced generic protections against Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and Cross-Site Scripting (XSS).

WAF and framework adapter mitigations for Next.js vulnerabilities

Multiple security vulnerabilities ↗ were disclosed and patched by the Next.js team through July 2026 security release. These include denial of service, middleware and proxy bypass, server-side request forgery, information disclosure, and cache poisoning across a range of severities.

Several of the disclosed vulnerabilities are not possible to block at WAF layer,we strongly recommend updating your application and its dependencies immediately. Patched versions are available through v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues.

Advisory
CVE
Severity
Issue
WAF Coverage

Denial of Service in App Router using Server Actions
CVE-2026-64641
High
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.
WAF rule Next.js - DoS - CVE-2026-64641 (...90dcdb0a) has been deployed to provide coverage.

Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-64642
High
Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.
This is a middleware bypass that unfortunately cannot be covered through Cloudflare WAF signature engine.

Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
CVE-2026-64645
High
A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.
Existing SSRF rules provide adequate coverage for this vulnerability, no tailored WAF rule was developed.

Server-Side Request Forgery in Server Actions on custom servers
CVE-2026-64649
High
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.
WAF rule Next.js - SSRF - CVE-2026-64649 (...930091a3) has been deployed to provide coverage.

Denial of Service in the Image Optimization API using SVGs
CVE-2026-64644
Medium
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint.
Malicious request is unfortunately indistinguishable from a legitimate image optimization request, so no WAF rule has been created to address this vulnerability.

Unbounded Server Action payload in Edge runtime
CVE-2026-64646
Medium
A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.
Unfortunately there is no one size fits all rule that can be deployed through WAF in lieu of custom bodySizeLimit configurations, so no WAF rule has been created to address this vulnerability.

Unauthenticated disclosure of internal Server Function endpoints
CVE-2026-64643
Medium
In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.
WAF rule Next.js - Information Disclosure - CVE-2026-64643 (...72952826) has been deployed to provide coverage.

Cache confusion of response bodies for requests with bodies
CVE-2026-64648
Medium
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the shape fetch(new Request(init), aDifferentInit)
This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
CVE-2026-64647
Medium
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters.
This is an application logic bug that unfortunately cannot be covered through Cloudflare WAF signature engine.

Key Findings

CVE-2026-48276: A path traversal vulnerability in Adobe ColdFusion file upload mechanisms allows unauthenticated attackers to write or upload files to arbitrary locations outside designated directories on the origin server.
CVE-2026-48282: A path traversal vulnerability in Adobe ColdFusion enables unauthenticated attackers to manipulate directory sequences and access restricted system files on the host filesystem.
CVE-2026-60137: An unauthenticated SQL injection vulnerability affecting WordPress. Threat actors exploit unsanitized input parameters to execute arbitrary SQL queries, leading to unauthorized database access, record manipulation, or data exfiltration.
CVE-2026-63030: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.

Ruleset

Rule ID
Legacy Rule ID
Description
Previous Action
New Action
Comments

Cloudflare Managed Ruleset
...215e7d31
N/A
SSRF - Restricted Protocol
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...a935ee5d
N/A
SSRF - Obfuscated Host
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...1b0230ac
N/A
LFI - Path Traversal
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...61349c8b
N/A
Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...9cb61eac
N/A
Adobe ColdFusion - Path Traversal - CVE:CVE-2026-48282
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...4ac5e21f
N/A
XSS — JS Bracket Concat Obfuscation - Body
Log
Disabled
This is a new detection.

Cloudflare Managed Ruleset
...f31f5559
N/A
XSS — JS Bracket Concat Obfuscation - Headers
Log
Disabled
This is a new detection.

Cloudflare Managed Ruleset
...987984fd
N/A
XSS — JS Bracket Concat Obfuscation - URI
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...ed933fcc
N/A
Wordpress - SQL Injection - CVE:CVE-2026-60137
N/A
Block
This was labeled as Generic Rules - SQLi.

Cloudflare Managed Ruleset
...550664b6
N/A
Wordpress - Remote Code Execution - CVE:CVE-2026-63030
N/A
Block
This was labeled as Generic Rules - Unauthenticated RCE.

Cloudflare Free Ruleset
...33697a1a
N/A
Wordpress - SQL Injection - CVE:CVE-2026-60137
N/A
Block
This was labeled as Generic Rules - SQLi.

Cloudflare Free Ruleset
...b5ec246a
N/A
Wordpress - Remote Code Execution - CVE:CVE-2026-63030
N/A
Block
This was labeled as Generic Rules - Unauthenticated RCE.

Cloudflare Managed Ruleset
...72952826
N/A
Next.js - Information Disclosure - CVE-2026-64643
N/A
Block
This is a new detection.

Cloudflare Managed Ruleset
...930091a3
N/A
Next.js - SSRF - CVE-2026-64649
N/A
Block
This is a new detection.

Cloudflare Managed Ruleset
...63167195
N/A
Next.js - Remote Code Execution - Cache Components
N/A
Block
This is a new detection.

Cloudflare Managed Ruleset
...90dcdb0a
N/A
Next.js - DoS - CVE-2026-64641
N/A
Block
This is a new detection.

Cloudflare Managed Ruleset
...2049a60c
N/A
Generic Rules - Command Execution - Body - Beta
Disabled

This detection has been removed.

Cloudflare Managed Ruleset
...836855a4
N/A
Generic Rules - Command Execution - Header - Beta
Disabled

This detection has been removed.

Cloudflare Managed Ruleset
...6d060a0d
N/A
Generic Rules - Command Execution - URI - Beta
Disabled

This detection has been removed.

Original source

Announcement Date

Release Date

Release Behavior

Legacy Rule ID

Rule ID

Description

Comments

2026-07-28
2026-08-03
Log
N/A
...01a076eb
SSRF - Cloud - Beta
This detection will be removed.

2026-07-28
2026-08-03
Log
N/A
...743a63ec
SSRF - Local - 2 - Beta
This detection will be removed.

2026-07-28
2026-08-03
Log
N/A
...c2e84e2d
SSRF - Cloud - Beta
This detection will be removed.

2026-07-28
2026-08-03
Log
N/A
...ab8af26f
SSRF - Cloud - 2 - Beta
This detection will be removed.

2026-07-28
2026-08-03
Log
N/A
...90dcdb0a
Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522
This is a new detection.

Original source

This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular web frameworks.

Key Findings

Generic Frameworks - Unauthenticated RCE: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.

Generic Frameworks - SQLi: Attackers can execute unauthorized database queries due to a failure to sanitize input values within request parameters.

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...550664b6

N/A

Generic Rules - Unauthenticated RCE

N/A

Block

This is a new detection.

Cloudflare Managed Ruleset

...ed933fcc

N/A

Generic Rules - SQLi

N/A

Block

This is a new detection.

Cloudflare Free Ruleset

...b5ec246a

N/A

Generic Rules - Unauthenticated RCE

N/A

Block

This is a new detection.

Cloudflare Free Ruleset

...33697a1a

N/A

Generic Rules - SQLi

N/A

Block

This is a new detection.

Original source

Key Findings

This release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).

CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.

CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...76973ac4

N/A

Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451

Log

Block

This is a new detection.

Cloudflare Managed Ruleset

...10233f36

N/A

Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037

Log

Block

This is a new detection.

Original source

Announcement Date

Release Date

Release Behavior

Legacy Rule ID

Rule ID

Description

Comments

2026-07-12
2026-07-20
Log
N/A
7fbdc9407bdb4a4eae2b3d91215e7d31
SSRF - Restricted Protocol
This is a new detection.

2026-07-12
2026-07-20
Log
N/A
6ca512d240d848d6a0c7ef42a935ee5d
SSRF - Obfuscated Host
This is a new detection.

2026-07-12
2026-07-20
Log
N/A
a3fb0870c38440d8a9a0eba81b0230ac
LFI - Path Traversal
This is a new detection.

2026-07-14
2026-07-20
Log
N/A
452a04be3f73458c863d8dae61349c8b
Adobe ColdFusion - File Upload Path Traversal - CVE:CVE-2026-48276
This is a new detection.

2026-07-14
2026-07-20
Log
N/A
a53a3fb491c64d74908081ee9cb61eac
Adobe ColdFusion - Path Traversal - CVE:CVE-2026-48282
This is a new detection.

2026-07-14
2026-07-20
Log
N/A
d8b63828c2344d919b94d2594ac5e21f
XSS — JS Bracket Concat Obfuscation - Body
This is a new detection.

2026-07-14
2026-07-20
Log
N/A
264a83a764be428ca41d516ff31f5559
XSS — JS Bracket Concat Obfuscation - Headers
This is a new detection.

2026-07-14
2026-07-20
Log
N/A
4ba21a60837244029183b782987984fd
XSS — JS Bracket Concat Obfuscation - URI
This is a new detection.

Original source