WAF - WAF Release - 2026-06-23

<p>This week's release introduces new managed protection to address a critical pre-authentication OS command injection vulnerability in Ivanti Sentry (CVE-2026-10520).</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-10520: An OS command injection vulnerability in Ivanti Sentry allows remote, unauthenticated attackers to execute arbitrary system commands with root privileges. The flaw stems from improper sanitization of input strings parsed during internal configuration handling.</li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="500a90789f874345b60b0de7242fdf83"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 500a90789f874345b60b0de7242fdf83" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...242fdf83</span></button></span></td><td>N/A</td><td>Ivanti Sentry - Command Injection - CVE:CVE-2026-10520</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr></tbody></table>