WAF Release - 2026-03-30

This week's release introduces new detections for a critical authentication bypass vulnerability in Fortinet products (CVE-2025-59718), alongside three new generic detection rules designed to identify and block HTTP Parameter Pollution attempts. Additionally, this release includes targeted protection for a high-impact unrestricted file upload vulnerability in Magento and Adobe Commerce.

Key Findings

• CVE-2025-59718: An improper cryptographic signature verification vulnerability in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication using a maliciously crafted SAML message, if that feature is enabled on the device.
• Magento 2 - Unrestricted File Upload: A critical flaw in Magento and Adobe Commerce allows unauthenticated attackers to bypass security checks and upload malicious files to the server, potentially leading to Remote Code Execution (RCE).

Impact

Successful exploitation of the Fortinet and Magento vulnerabilities could allow unauthenticated attackers to gain administrative control or deploy webshells, leading to complete server compromise and data theft.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · 4f7d513cea424c2a853881982f7f95e9 · N/A · Generic Rules - Parameter Pollution - Body · Log · Disabled · This is a new detection.

Cloudflare Managed Ruleset · 60d023f3be414d379428add3319731a4

N/A · Generic Rules - Parameter Pollution - Header - Form · Log · Disabled

This is a new detection.

Cloudflare Managed Ruleset · 2dde02d792ad41ec8fd65c2bdef262dd

N/A · Generic Rules - Parameter Pollution - URI · Log · Disabled

This is a new detection.

Cloudflare Managed Ruleset · ab8a96ed13034d56a81a79e570a36147 · N/A · Magento 2 - Unrestricted file upload · Log · Block · This is a new detection.

Cloudflare Managed Ruleset · 0a13a38dd81c44688950444e2ffcca9f · N/A · Fortinet FortiCloud SSO - Authentication Bypass - CVE:CVE-2025-59718 · Log · Block · This is a new detection.