WAF - WAF Release - 2026-06-15

<p>This week's release introduces new managed protection to address a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) and a new generic rule designed to identify and block sophisticated SQL Injection (SQLi) bypass attempts leveraging obfuscated boolean logic. These rules protect affected installations from unauthorized data exfiltration at the network edge.</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-26980: A blind SQL injection vulnerability in the Ghost CMS Content API (versions 3.24.0 to 6.19.0) allows unauthenticated remote attackers to inject malicious SQL commands via query parameters due to improper input validation.</li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="439c4ef64b32447989bdf412b4c29bc6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 439c4ef64b32447989bdf412b4c29bc6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...b4c29bc6</span></button></span></td><td>N/A</td><td>Ghost CMS - SQLi - CVE:CVE-2026-26980</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="6c64b68ef5ed45e7a622cdaab56f403f"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 6c64b68ef5ed45e7a622cdaab56f403f" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...b56f403f</span></button></span></td><td>N/A</td><td>SQLi - Obfuscated Boolean - URI</td><td>Log</td><td>Disabled</td><td><p>This is a new detection.</p></td></tr></tbody></table>