Application Security Updates & Release Notes

This emergency release adds a new managed rule to block active exploitation of a critical remote code execution (RCE) vulnerability found in popular web frameworks.

Key Findings

Generic Rules - Remote Code Execution: Attackers can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.

Ruleset

Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset ...fd1bf420 N/A Generic Rules - Remote Code Execution N/A Block Original source

Cloudflare now preserves Workers context when a subrequest targets a Cloudflare-proxied hostname using Bring Your Own IP (BYOIP). These requests are identified as Cloudflare-to-Cloudflare traffic instead of external Internet traffic.

Previously, some BYOIP subrequests could lose Workers context and original client signals. This could cause security rules to behave unexpectedly, Bot Management to evaluate an internal Cloudflare connection instead of the original client, or affected requests to return false 403 responses.

Workers subrequests to BYOIP destinations now preserve the CF-Worker header and cf.worker.upstream_zone field. This supports consistent security rule evaluation across same-zone and cross-zone subrequests.

Bot Management fields on the destination zone now represent the original end-user connection for affected BYOIP subrequests. Bot scores, verified bot status, and JA3/JA4 fingerprints no longer represent the internal connection between Cloudflare services.

Customers benefit from consistent security rule evaluation, accurate Bot Management results, and fewer unexpected failures when Workers access BYOIP-backed hostnames. The improvement is automatic and requires no configuration changes.

For more information, refer to Cloudflare BYOIP and Workers subrequests.

Original source

You can now manually request an API Shield schema learning run without waiting for the weekly schedule. Use this during testing after sending representative traffic to your API.

In Web Assets > Operations, open the More options menu for the operations table and select Ad-hoc learn schema. In the Schema learning dialog, select Run learning. The run covers the entire zone and uses observed traffic. Existing learning thresholds still apply.

The dialog shows the learning status and last completed run for the zone. The Learned schema view shows the learning result and last learning run for each operation. You can review individual results while the zone-wide run continues.

For instructions and traffic requirements, refer to Run schema learning manually.

Original source

This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.

Key Findings

CVE-2026-102989: A reflected Cross-Site Scripting (XSS) vulnerability affecting TanStack. Unauthenticated attackers can exploit this flaw to inject malicious scripts into web pages viewed by other users, potentially leading to session hijacking or unauthorized actions.

CVE-2026-21589: An arbitrary file access vulnerability affecting Atlassian products. Threat actors can exploit this flaw to read unauthorized files on the target system, risking the exposure of sensitive configuration data.

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset
...02751ef3
N/A
Generic Rules - Template Injection - 2 - Beta
Disabled
Disabled
This rule is merged into the original rule "Generic Rules - Template Injection - 2" (ID: ...d3ed0123).

Cloudflare Managed Ruleset
...4ee560b2
N/A
TanStack - Reflected XSS - CVE:CVE-2026-102989
N/A
Block
This is a new detection.

Cloudflare Managed Ruleset
...e919cd31
N/A
Atlassian - Arbitrary File Access - CVE:CVE-2026-21589
N/A
Block
This is a new detection.

Original source

You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.

The field is an Array<String> of detection IDs that reports failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections for personally identifiable information (PII), prompt injection, custom topics, and unsafe topics.

The field does not alter the existing behavior of detections. Use it in rules to choose how to handle requests with reported failures.

When no failures are reported, the field returns []. You can use it on all plans, but your plan must still include the detections and rule features you want to use.

Supported rules

• Custom rules at the zone and account levels
• Rate limiting rules at the zone and account levels
• Request Header Transform Rules at the zone level

Match any reported failure

len(cf.appsec.request.failed_detections) gt 0

Match a reported leaked credentials detection failure

any(cf.appsec.request.failed_detections[*] eq "waf_credential_check")

For more information, refer to the Failed detections field reference.

Original source

AI Security for Apps now supports an updated set of categories for detecting unsafe topics in incoming prompts.

The values available in cf.llm.prompt.unsafe_topic_categories have changed. Existing WAF custom rules remain valid, but rules that reference a removed or renamed category will no longer match that category. Review any rules that use this field and update their expressions to use the currently supported values.

For category descriptions and configuration guidance, refer to Unsafe topics.

Original source

This release introduces a new detection to mitigate a heap-based buffer overflow vulnerability in F5 BIG-IP, and enhances existing command injection protections by incorporating tested beta logic into the baseline rule.

Key Findings

CVE-2026-94127: A heap-based buffer overflow vulnerability in F5 BIG-IP. Attackers can exploit this flaw to execute arbitrary code on the affected system.

Ruleset

Rule ID
Legacy Rule ID
Description
Previous Action
New Action
Comments

Cloudflare Managed Ruleset
...a056caff
N/A
Command Injection - Generic 8 - uri - Beta
Log
Block
This rule is merged into the original rule "Command Injection - Generic 8 - uri" (ID: ...ee159e2e).

Cloudflare Managed Ruleset
...7206c737
N/A
F5 BIG-IP - UnAuth Heap-Overflow - CVE:CVE-2026-94127
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...549f7356
N/A
Next.js - Cache Poisoning - CVE:CVE-2026-94543
Block
Block
Rule metadata description refined. Detection unchanged.

Original source

This update provides immediate defense against a vulnerability affecting Citrix NetScaler ADC and Gateway appliances, deploying protection against improper input validation vectors.

Key Findings

CVE-2026-88771: An improper input validation vulnerability affecting Citrix NetScaler ADC and Gateway allows an unauthenticated attacker to execute arbitrary commands.

Impact

We strongly recommend that administrators apply the latest versions to fully secure origin servers. Additionally, customers should review configurations against applicable preconditions and follow standard incident response processes if signs of compromise are identified.

Detailed Rule Changes

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...827ab216

N/A

Citrix Netscaler ADC and Gateway - Improper input validation - CVE:CVE-2026-88771

N/A

Block

This is a new detection.

Original source

This release introduces new detections to enhance protection against a specific GitLab path traversal vulnerability, alongside advanced generic rules targeting HTTP request smuggling, directory traversal, and command injection attempts.

Key Findings

CVE-2026-85706: A path traversal vulnerability affecting GitLab.

Ruleset

Rule ID
Legacy Rule ID
Description
Previous Action
New Action
Comments

Cloudflare Managed Ruleset
...cb14ded8
N/A
Broken Access Control - Directory Traversal
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...0364bd7e
N/A
HTTP Request Smuggling - Request Body Anomaly - Beta
Log
Block
This rule is merged into the original rule "HTTP/2 Request Smuggling - Request Body Anomaly" (ID: ...1489d892).

Cloudflare Managed Ruleset
...d498a69a
N/A
Command Injection - Generic 8 - body - Beta
Disabled
Disabled
This rule is merged into the original rule "Command Injection - Generic 8 - body" (ID: ...413592e2).

Cloudflare Managed Ruleset
...87ae8cfc
N/A
GitLab - Path Traversal- CVE:CVE-2026-85706
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...549f7356
N/A
Generic - Request routing cache inconsistency
N/A
Block
This is a new detection.

Original source

This update provides immediate defense against critical vulnerabilities affecting WordPress and JFrog Artifactory, including path traversal, local file inclusion (LFI), cross-site scripting (XSS), and authentication bypass exploits.

Key Findings

CVE-2026-87902: A high-severity Path Traversal and Local File Inclusion (LFI) vulnerability affecting WordPress. Unauthenticated attackers can exploit this flaw to read arbitrary files on the host server, potentially exposing sensitive configuration data or system files.

CVE-2026-42018 & CVE-2026-82329: Critical authentication bypass vulnerabilities affecting JFrog Artifactory. Successful exploitation allows unauthenticated attackers to bypass security controls and achieve unauthorized access to the Artifactory instance.

Impact

We strongly recommend that administrators apply the latest vendor patches for WordPress and JFrog Artifactory to fully secure origin servers.

Detailed Rule Changes

Ruleset

Rule ID

Legacy Rule ID

Description

Previous Action

New Action

Comments

Cloudflare Managed Ruleset

...70a43f96

N/A

Wordpress - Path Traversal, Local File Inclusion - CVE:CVE-2026-87902

N/A

Block

This is a new detection.

Cloudflare Managed Ruleset

...909a4db4

N/A

Wordpress - XSS - Comment

N/A

Block

This is a new detection.

Cloudflare Managed Ruleset

...c797ef03

N/A

JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-42018

N/A

Block

This is a new detection.

Cloudflare Managed Ruleset

...a813ac74

N/A

JFrog Artifactory - Authentication Bypass - CVE:CVE-2026-82329

N/A

Block

This is a new detection.

Original source

This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments.

Ruleset

Rule ID
Legacy Rule ID
Description
Previous Action
New Action
Comments

Cloudflare Managed Ruleset
...5f21b651
N/A
SSRF - Cloud,Link-Local non-standard IP notation
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...0f0313d6
N/A
SSRF - Block jar HTTP loopback payload
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...75cd912a
N/A
SSRF - Local non-standard IP notation
Log
Block
This is a new detection.

Cloudflare Managed Ruleset
...a1ba83f6
N/A
SSTI - Jinja Dangerous Globals Chain
Log
Block
This is a new detection.

Original source

Announcement Date

Release Date

Release Behavior

Legacy Rule ID

Rule ID

Description

Comments

2026-09-22
2026-09-29
Log
N/A
...cb14ded8
Broken Access Control - Directory Traversal
This is a new detection.

2026-09-22
2026-09-29
Log
N/A
...0364bd7e
HTTP Request Smuggling - Request Body Anomaly - Beta
This rule will be merged into the original rule "HTTP/2 Request Smuggling - Request Body Anomaly" (ID: ...1489d892).

2026-09-22
2026-09-29
Disabled
N/A
...d498a69a
Command Injection - Generic 8 - body - Beta
This rule will be merged into the original rule "Command Injection - Generic 8 - body" (ID: ...413592e2).

2026-09-22
2026-09-29
Log
N/A
...a056caff
Command Injection - Generic 8 - uri - Beta
This rule will be merged into the original rule "Command Injection - Generic 8 - uri" (ID: ...ee159e2e).

2026-09-22
2026-09-29
Log
N/A
...87ae8cfc
GitLab - Path Traversal- CVE:CVE-2026-85706
This is a new detection.

Original source