WAF - WAF Release - 2025-10-20

This week’s update introduces an enhanced rule that expands detection coverage for a critical vulnerability in Oracle E-Business Suite. It also improves an existing rule to provide more reliable coverage in request processing.

Key Findings

New WAF rule deployed for Oracle E-Business Suite (CVE-2025-61882) to block unauthenticated attacker's network access via HTTP to compromise Oracle Concurrent Processing. If successfully exploited, this vulnerability may result in remote code execution.

Impact

• Successful exploitation of CVE-2025-61882 allows unauthenticated attackers to execute arbitrary code remotely by chaining multiple weaknesses, enabling lateral movement into internal services, data exfiltration, and large-scale extortionware deployment within Oracle E-Business Suite environments.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...2b4101ab100598ARemote Code Execution - Common Bash Bypass - BetaLogBlockThis rule is merged into the original rule "Remote Code Execution - Common Bash Bypass" (ID: ...50cec478)Cloudflare Managed Ruleset...a1118614100916AOracle E-Business Suite - Remote Code Execution - CVE:CVE-2025-61882 - 2LogBlockThis is a New DetectionCloudflare Managed Ruleset...c22b51d3N/AHTTP TruncatedN/ADisabledThis is a New Detection