Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds

← Back to all posts

WAF Release - 2026-06-23

Jun 23, 2026

WAF

This week's release introduces new managed protection to address a critical pre-authentication OS command injection vulnerability in Ivanti Sentry (CVE-2026-10520).

Key Findings

• CVE-2026-10520: An OS command injection vulnerability in Ivanti Sentry allows remote, unauthenticated attackers to execute arbitrary system commands with root privileges. The flaw stems from improper sanitization of input strings parsed during internal configuration handling.

Ruleset	Rule ID	Legacy Rule ID	Description	Previous Action	New Action	Comments
Cloudflare Managed Ruleset	...242fdf83	N/A	Ivanti Sentry - Command Injection - CVE:CVE-2026-10520	Log	Block	This is a new detection.