WAF - WAF Release - 2026-08-04

<p>This release introduces new rules and updates Microsoft SharePoint RCE alongside enhanced SSRF cloud protection rule actions.</p> <p><strong>Key Findings</strong></p> <ul> <li>CVE-2026-50522: An insecure deserialization vulnerability in Microsoft SharePoint Server. This may allow an unauthenticated attacker to execute arbitrary code using crafted requests.</li> <li>CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and achieve Remote Code Execution (RCE) using maliciously crafted payload requests.</li> <li>Generic Cloud Protections: Added improved detection logic targeting Server-Side Request Forgery (SSRF) in cloud-hosted applications.</li> </ul> <table style="width: 100%"><thead><tr><th>Ruleset</th><th>Rule ID</th><th>Legacy Rule ID</th><th>Description</th><th>Previous Action</th><th>New Action</th><th>Comments</th></tr></thead><tbody><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="91aee93c31944828bf86f068052b07cf"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 91aee93c31944828bf86f068052b07cf" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...052b07cf</span></button></span></td><td>N/A</td><td>Microsoft SharePoint - Remote Code Execution - CVE:CVE-2026-50522</td><td>Log</td><td>Block</td><td><p>This is a new detection.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="89d0243997d24c6ea1d610a23a5b40d6"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 89d0243997d24c6ea1d610a23a5b40d6" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...3a5b40d6</span></button></span></td><td>N/A</td><td>Rails - Arbitrary File Read &amp; RCE - CVE:CVE-2026-66066</td><td>Block</td><td>Block</td><td><p>This was labeled as File Upload - RCE.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="98bfd6bb46074d5b8d1c4b39743a63ec"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 98bfd6bb46074d5b8d1c4b39743a63ec" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...743a63ec</span></button></span></td><td>N/A</td><td>SSRF - Local - 2 - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="54e1733b10da4a599e06c6fbc2e84e2d"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 54e1733b10da4a599e06c6fbc2e84e2d" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...c2e84e2d</span></button></span></td><td>N/A</td><td>SSRF - Cloud - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="ecd26d61a75e46f6a4449a06ab8af26f"><button type="button" title="Copy rule ID" aria-label="Copy rule ID ecd26d61a75e46f6a4449a06ab8af26f" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...ab8af26f</span></button></span></td><td>N/A</td><td>SSRF - Cloud - 2 - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="281a1b7086b84db7a695220725ba9d7c"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 281a1b7086b84db7a695220725ba9d7c" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...25ba9d7c</span></button></span></td><td>N/A</td><td>SSRF - Cloud</td><td>Disabled</td><td>Block</td><td><p>We are changing the action for this rule from Disabled to BLOCK</p></td></tr><tr><td>Cloudflare Managed Ruleset</td><td><span class="rule-id" data-rule-id="158177dec2504acdba1f2da201a076eb"><button type="button" title="Copy rule ID" aria-label="Copy rule ID 158177dec2504acdba1f2da201a076eb" class="border-border bg-muted hover:border-foreground/30 hover:bg-accent inline-flex cursor-copy items-center rounded-md border px-1.5 py-0.5 transition-colors duration-150"><span class="font-mono text-[0.8125rem] font-medium">...01a076eb</span></button></span></td><td>N/A</td><td>SSRF - Local - Beta</td><td>Disabled</td><td> - </td><td><p>This detection has been removed.</p></td></tr></tbody></table>