WAF - WAF Release - 2026-07-01

<p>This release adds targeted coverage for a path traversal flaw in Fortinet FortiSandbox (CVE-2026-39813) and transitions the Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule action from Block to Disabled.</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-39813: A path traversal vulnerability in Fortinet FortiSandbox allows remote, unauthenticated attackers to read arbitrary files from the underlying filesystem due to insufficient validation of user-supplied input paths.</li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="32075e19b1494117ac5915e8d84c92c9"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 32075e19b1494117ac5915e8d84c92c9" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...d84c92c9</span></button></span></td><td>N/A</td><td>Fortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="ae20608d93b94e97988db1bbc12cf9c8"><button type="button" title="Copy rule ID" aria-label="Copy rule ID ae20608d93b94e97988db1bbc12cf9c8" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...c12cf9c8</span></button></span></td><td>N/A</td><td>Anomaly:Header:User-Agent - Fake Bing or MSN Bot</td><td>Enabled</td><td>Disabled</td><td><p>We are changing the action for this rule from BLOCK to Disabled</p></td></tr></tbody></table>