WAF - WAF Release - 2025-09-26

Managed Ruleset Updated

This update introduces 11 new detections in the Cloudflare Managed Ruleset (all currently set to Disabled mode to preserve remediation logic and allow quick activation if needed). The rules cover a broad spectrum of threats - SQL injection techniques, command and code injection, information disclosure of common files, URL anomalies, and cross-site scripting.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...a67d8561100859ASQLi - UNION - 3N/ADisabledThis is a New DetectionCloudflare Managed Ruleset...4de80468100889Command Injection - Generic 9N/ADisabledThis is a New DetectionCloudflare Managed Ruleset...f2be3ddf100890Information Disclosure - Common Files - 2N/ADisabledThis is a New DetectionCloudflare Managed Ruleset...80a252a8100891Anomaly:URL - Relative PathsN/ADisabledThis is a New DetectionCloudflare Managed Ruleset...7e7d3865100894XSS - Inline FunctionN/ADisabledThis is a New DetectionCloudflare Managed Ruleset...3792565c100895XSS - DOMN/ADisabledThis is a New DetectionCloudflare Managed Ruleset...42978e38100896SQLi - MSSQL Length EnumerationN/ADisabledThis is a New DetectionCloudflare Managed Ruleset...3ab43f7e100897Generic Rules - Code Injection - 3N/ADisabledThis is a New DetectionCloudflare Managed Ruleset...c1686741100898SQLi - EvasionN/ADisabledThis is a New DetectionCloudflare Managed Ruleset...20999be0100899SQLi - Probing 2N/ADisabledThis is a New DetectionCloudflare Managed Ruleset...b4026c88100900SQLi - ProbingN/ADisabledThis is a New Detection