Release-Sep-28-2025 Emergency

Author: vs-mg

src/content/changelog/waf/2025-09-28-emergency-waf-release.mdx

@@ -0,0 +1,55 @@
+---
+title: "WAF Release - 2025-09-28 - Emergency"
+description: Cloudflare WAF managed rulesets 2025-09-28 emergency release
+date: 2025-09-28
+---
+
+import { RuleID } from "~/components";
+
+This week highlights a critical vendor-specific vulnerability: a deserialization flaw in the License Servlet of Fortra’s GoAnywhere MFT. By forging a license response signature, an attacker can trigger deserialization of arbitrary objects, potentially leading to command injection.
+
+**Key Findings**
+
+* Cisco (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363): Multiple vulnerabilities that could allow attackers to exploit unsafe deserialization and input validation flaws. Successful exploitation may result in arbitrary code execution, privilege escalation, or command injection on affected systems.
+
+**Impact**
+
+Cisco (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363): Exploitation enables attackers to escalate privileges or achieve remote code execution via command injection.
+
+<table style="width: 100%">
+  <thead>
+    <tr>
+      <th>Ruleset</th>
+      <th>Rule ID</th>
+      <th>Legacy Rule ID</th>
+      <th>Description</th>
+      <th>Previous Action</th>
+      <th>New Action</th>
+      <th>Comments</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>Cloudflare Managed Ruleset</td>
+      <td>
+        <RuleID id="a1bef4ada0b146d2862cad439ee0ab84" />
+      </td>
+      <td>100788</td>
+      <td>Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363</td>
+      <td>N/A</td>
+      <td>Disabled</td>
+      <td>This is a New Detection</td>
+    </tr>
+    <tr>
+      <td>Cloudflare Managed Ruleset</td>
+      <td>
+        <RuleID id="51de6ce6596a40eb8200452ad30f768e" />
+      </td>
+      <td>100788A</td>
+      <td>Cisco Secure Firewall Adaptive Security Appliance - Remote Code Execution - CVE:CVE-2025-20333, CVE:CVE-2025-20362, CVE:CVE-2025-20363</td>
+      <td>N/A</td>
+      <td>Disabled</td>
+      <td>This is a New Detection</td>
+    </tr>
+  </tbody>
+</table>