{"id":"CVE-2026-20079","kind":"vulnerability","aliases":["CVE-2026-20079"],"related":[],"title":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an…","description":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","summary":"Unauthenticated remote attacker sends crafted HTTP requests to the FMC web interface, bypasses authentication and runs scripts as root (CWE-288, CVSS 10.0). It affects all on-prem FMC releases regardless of configuration. Cisco says it is actively exploited (since Aug 2026). There are no workarounds. Cisco SCC Firewall Management is SaaS and Cisco has already patched it. FTD, ASA, FDM and SCC are not affected. Reducing public exposure of the management interface reduces the attack surface but does not fix it.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-09-09T00:00:00+00:00","products":[{"name":"Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Cisco Secure Firewall Management Center (FMC)","fixed":["7.0.10","7.2.12","7.4.8","7.6.6","7.7.13","10.0.2","10.1.0"],"affected":"all releases below the first fixed release per train (<= 7.0.9, 7.2 < 7.2.12, 7.4 < 7.4.8, 7.6 < 7.6.6, 7.7 < 7.7.13, 10.0 < 10.0.2)","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.0","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.0.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.1.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.2","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.2.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.3","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.4","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.5","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.6","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.6.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.6.2","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.6.3","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.7","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.8","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.8.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.0.9","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.1.0","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.1.0.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.1.0.2","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.1.0.3","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.0","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.0.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.2","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.3","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.3.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.4","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.4.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.5","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.5.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.5.2","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.6","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.7","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.8","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.8.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.9","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.10","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.10.1","ecosystem":"vendor"},{"name":"cisco secure firewall management center","fixed":[],"affected":"= 7.2.10.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","cloudflare","exploited","firewall-management","fmc","lab-disclosure","rce","self-hosted","unauthenticated","vendor"],"not_affected_if":["fixed-version","managed-hosting","saas-scc"],"how_to_check":"In FMC expert mode (sudo su), run: zgrep \"package_info.*license\" /var/log/messages*. A hit containing /var/tmp/license.tmp (e.g. 'www : USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/tmp/license.tmp --lsm') means it may have been exploited. Contact Cisco TAC if so. Hot fixes and upgrades prevent future exploitation but may not clean an existing compromise. Also check your FMC version against the fixed table, or use the Cisco Software Checker. Cisco lists Snort rules 66075-66080.","fix":"Upgrade FMC to the first fixed hardening release for your train: 7.0 and earlier -> 7.0.10; 7.2 -> 7.2.12; 7.4 -> 7.4.8; 7.6 -> 7.6.6; 7.7 -> 7.7.13; 10.0 -> 10.0.2; 10.1 -> 10.1.0. These replace the earlier hot fixes. There is no workaround. Meanwhile, keep the FMC management interface off the public internet. SCC Firewall Management needs no action.","status":"resolved","published_at":"2026-03-04T18:16:24+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:34+00:00","updated_at":"2026-10-24T19:12:57+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-23T20:31:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco mitigation or patch per the vendor advisory; CISA says to discontinue use of the product if mitigations are unavailable. Affected versions and fixed releases are unknown from these sources.","summary":"Cisco Secure Firewall Management Center and Security Cloud Control firewall management contain an authentication bypass through an alternate path that lets an unauthenticated remote attacker run script files on the device. Successful exploitation gives root access to the underlying operating system, and CISA lists it as actively exploited.","category":"vendor","who_cares":["cisco","firewall-management","self-hosted"],"confidence":0.8,"analyst_note":"Find the Cisco security advisory for CVE-2026-20079 to get affected versions, fixed releases, and IOC or exposure-check steps; the CISA KEV entry does not list them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000405,"input_tokens":2339,"output_tokens":342,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Cisco security advisory for CVE-2026-20079 to get affected versions, fixed releases, and IOC or exposure-check steps; the CISA KEV entry does not list them.","search":"'-04':343C,359C '-15':344C,360C '-20079':19A,22A,397C,434C,584C '-2026':18A,21A,380C,396C,402C,425C,433C,468C,490C,583C,606C,628C,647C,667C '-21643':403C,469C,607C '-23864':648C,668C '-23869':426C '-288':278B '-33057':381C,491C,629C '0af34bba':694C '1':649C,669C '10.0':280B '15':354C '2026':300B,342C,355C,358C '50c08f6f':640C '61680354':671C 'access':479C 'action':566C,568C 'activ':296B 'addit':404C 'address':418C 'administr':481C,536C,549C 'aef9415b':573C 'affect':282B,324B 'allow':16A,452C,528C 'alongsid':382C 'alreadi':314B 'and':29A 'appli':554C 'april':353C 'arbitrari':459C,507C,533C 'asa':318B 'attack':260B,334B,456C,504C,530C 'aug':299B 'auth':601C 'authent':271B 'base':441C,499C 'base64':514C,624C 'base64-encoded':513C 'beta':650C,683C,702C 'block':586C,609C,631C,652C 'bodi':520C 'bypass':270B,462C 'c953a72b':618C 'center':12A,27A,40A,46A,51A,56A,61A,66A,71A,76A,81A,86A,91A,96A,101A,106A,111A,116A,121A,126A,131A,136A,141A,146A,151A,156A,161A,166A,171A,176A,181A,186A,191A,196A,201A,206A,211A,216A,221A,226A,231A,236A,241A,394C,449C 'changelog':345C,346C 'cisco':8A,23A,36A,42A,47A,52A,57A,62A,67A,72A,77A,82A,87A,92A,97A,102A,107A,112A,117A,122A,127A,132A,137A,142A,147A,152A,157A,162A,167A,172A,177A,182A,187A,192A,197A,202A,207A,212A,217A,222A,227A,232A,237A,242B,292B,305B,312B,390C,429C,445C,575C 'cloud':31A 'cloudflar':243B,352C,570C,592C,615C,637C,672C,691C 'code':373C,508C,534C,622C 'command':460C 'comment':569C 'configur':291B,482C 'control':32A,537C 'could':15A,527C 'coverag':416C 'craft':262B,485C,512C 'critic':371C,471C 'cve':17A,20A,379C,395C,401C,424C,432C,467C,489C,581C,582C,604C,605C,626C,627C,645C,646C,665C,666C 'cvss':279B 'cwe':277B 'descript':564C 'detect':368C,591C,614C,636C,690C,709C 'disabl':685C,704C 'disclosur':251B 'dos':415C,644C,664C 'ebd81645':675C 'ee7be621':595C 'em':400C,466C,476C,598C 'emb':699C 'encod':515C 'encourag':552C 'execut':374C,458C,506C,532C,623C 'exhaust':422C,548C 'exist':412C 'exploit':244B,297B,523C 'exposur':327B 'fdm':319B 'filter':464C 'find':428C 'firewal':10A,246B,307B,392C,447C 'firewall':25A,34A,38A,44A,49A,54A,59A,64A,69A,74A,79A,84A,89A,94A,99A,104A,109A,114A,119A,124A,129A,134A,139A,144A,149A,154A,159A,164A,169A,174A,179A,184A,189A,194A,199A,204A,209A,214A,219A,224A,229A,234A,239A 'firewall-manag':245B 'fix':339B 'fmc':13A,28A,41A,248B,267B,287B,431C,450C,577C 'forticli':399C,465C,475C,597C 'framework':501C 'ftd':317B 'gain':535C 'high':386C 'high-impact':385C 'host':255B 'html':678C,697C 'http':263B,486C 'id':560C,563C,670C 'identifi':420C 'impact':387C,521C 'improv':350C 'includ':407C 'infrastructur':541C 'inject':603C,679C,698C 'interfac':6A,269B,331B,443C 'introduc':365C 'key':427C 'lab':250B 'lab-disclosur':249B 'legaci':561C 'link':680C 'log':585C,608C,630C,651C 'manag':11A,247B,308B,330B,393C,442C,448C,540C,571C,593C,616C,638C,673C,692C 'management':26A,35A,39A,45A,50A,55A,60A,65A,70A,75A,80A,85A,90A,95A,100A,105A,110A,115A,120A,125A,130A,135A,140A,145A,150A,155A,160A,165A,170A,175A,180A,185A,190A,195A,200A,205A,210A,215A,220A,225A,230A,235A,240A 'manipul':483C 'merg':657C 'mesop':378C,488C,496C,620C 'n/a':574C,596C,619C,641C,676C,684C,695C,703C 'network':539C 'new':347C,367C,567C,590C,613C,635C,689C,708C 'offici':555C 'on-prem':284B 'origin':660C 'patch':315B 'payload':516C,625C 'permit':477C 'pre':600C 'pre-auth':599C 'prem':286B 'previous':565C 'protect':383C 'public':326B 'python':498C 'python-bas':497C 'rce':252B,375C,578C 'react':413C,642C,662C 'recent':419C 'reduc':325B,332B 'regardless':289B 'releas':288B,341C,357C,364C,406C 'remot':259B,372C,455C,621C 'request':264B,487C,519C 'resourc':421C,547C 'root':276B 'rule':559C,562C,654C,661C 'ruleset':558C,572C,594C,617C,639C,674C,693C 'run':273B 'saa':310B 'say':293B 'scc':33A,306B,321B 'script':274B 'secur':9A,391C,430C,446C,463C,576C 'secure':24A,37A,43A,48A,53A,58A,63A,68A,73A,78A,83A,88A,93A,98A,103A,108A,113A,118A,123A,128A,133A,138A,143A,148A,153A,158A,163A,168A,173A,178A,183A,188A,193A,198A,203A,208A,213A,218A,223A,228A,233A,238A 'security':30A 'self':254B 'self-host':253B 'send':261B,510C 'server':414C,545C,643C,663C 'server-sid':544C 'side':546C 'sinc':298B 'softwar':14A 'special':511C 'sql':602C 'strong':551C 'success':522C 'surfac':335B 'tag':681C,700C 'trigger':543C 'ui':500C 'unauthent':256B,258B,454C,503C,529C 'unauthor':478C 'updat':348C,409C,557C 'upgradereadinesscal':580C 'uri':682C,701C 'vector':423C 'vendor':257B,556C 'via':484C,579C 'vulner':2A,376C,388C,436C,472C,493C,526C 'waf':340C,356C 'web':5A,268B,440C 'web-bas':439C 'week':362C 'workaround':304B 'xss':677C,696C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-04-15","covers":"HTTP requests matched by the Cloudflare Managed Ruleset rule for Cisco Secure FMC RCE via upgradeReadinessCall (action changed from Log to Block)","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:12:01Z","confidence":0.9,"source_title":"WAF Release - 2026-04-15 · Changelog","customer_action":"apply official vendor updates from Cisco, which the rule does not replace"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-04T18:16:24+00:00","kev":{"dateAdded":"2026-09-09","dueDate":"2026-09-12","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20079","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079","severity":null,"published_at":"2026-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-20079:87","url":null,"severity":null,"published_at":"2026-10-23T21:29:00+00:00","modified_at":"2026-10-23T21:29:00+00:00","first_seen_at":"2026-10-23T21:29:00+00:00","fetched_at":"2026-10-23T21:29:00+00:00","note":"Read Cisco advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2 (rev 2.6, 2026-09-16): CVSS 10.0, exploited since Aug 2026 per Cisco PSIRT, KEV 2026-09-09 per Canadian Cyber Centre. Fix versions and IOC from advisory. No public PoC found (not searched beyond advisory)."},{"source":"nvd","external_id":"CVE-2026-20079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20079","severity":null,"published_at":"2026-03-04T18:16:24+00:00","modified_at":"2026-09-16T17:17:16+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/#CVE-2026-20079","url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","severity":null,"published_at":"2026-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-15 · Changelog"}],"documents":[{"id":1037,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2","title":"Cisco Secure FMC Software Authentication Bypass Vulnerability (cisco-sa-onprem-fmc-authbypass-5JPp45V2)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1039,"url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-197","title":"Canadian Cyber Centre AV26-197 (KEV addition 2026-09-09)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2921,"url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","title":"Cloudflare: WAF Release - 2026-04-15 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","published_at":"2026-04-15T00:00:00+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}