FeatureJun 23, 2026

WAF Release - 2026-06-23

This week's release introduces new managed protection to address a critical pre-authentication OS command injection vulnerability in Ivanti Sentry (CVE-2026-10520).

Key Findings

CVE-2026-10520: An OS command injection vulnerability in Ivanti Sentry allows remote, unauthenticated attackers to execute arbitrary system commands with root privileges. The flaw stems from improper sanitization of input strings parsed during internal configuration handling.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · 500a90789f874345b60b0de7242fdf83 · N/A · Ivanti Sentry - Command Injection - CVE:CVE-2026-10520 · Log · Block ·

This is a new detection.

Read the original announcement

All WAF updates →

WAF Release - 2026-10-12
This release introduces new detections to mitigate recent vulnerabilities affecting TanStack and Atlassian products.
WAFFeatureOct 12, 2026
WAF Release - Scheduled changes for 2026-10-19
Announcement Date Release Date Release Behavior Legacy Rule ID Rule ID Description Comments 2026-10-12 2026-10-19 Log N/A d60e605ed36842df9ca0232f5ea9966d Broken Access Control - Directory Traversal (Beta) This rule will be merged into the original rule "Broken Access Control -…
WAFFeature

WAF Release - 2026-06-23

More from WAF

WAF Release - 2026-06-23

More from WAF