Skip to content
Cloud ChangelogAnnouncements from AWS, Google Cloud, Azure, Cloudflare and the main AI providers in one searchable changelog, with daily, weekly and monthly digests.
Get the digest
Back to feed

July 1, 2026 · Cloudflare

WAF - WAF Release - 2026-07-01

This release adds targeted coverage for a path traversal flaw in Fortinet FortiSandbox (CVE-2026-39813) and transitions the Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule action from Block to Disabled.

Key Findings

  • CVE-2026-39813: A path traversal vulnerability in Fortinet FortiSandbox allows remote, unauthenticated attackers to read arbitrary files from the underlying filesystem due to insufficient validation of user-supplied input paths.
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionCommentsCloudflare Managed Ruleset...d84c92c9N/AFortinet FortiSandbox - Path Traversal - CVE:CVE-2026-39813LogBlock

This is a new detection.

Cloudflare Managed Ruleset...c12cf9c8N/AAnomaly:Header:User-Agent - Fake Bing or MSN BotEnabledDisabled

We are changing the action for this rule from BLOCK to Disabled

Read on developers.cloudflare.com
Cloud Changelog

Announcements from AWS, Google Cloud, Azure, Cloudflare and the main AI providers in one searchable changelog, with daily, weekly and monthly digests.

Cloud Changelog is an independent site. It is not affiliated with or endorsed by Amazon Web Services, Google, Microsoft, Cloudflare, OpenAI, Anthropic, Mistral AI or xAI. Their names and trademarks belong to their owners.