Release-Aug-07-2025- Emergency (#24251)

* Release-Aug-07-2025- Emergency

* Release-Aug-07-2025- Emergency

Author: vs-mg

src/content/changelog/waf/2025-08-07-emergency-waf-release.mdx

@@ -0,0 +1,61 @@
+---
+title: "WAF Release - 2025-08-07 - Emergency"
+description: Cloudflare WAF managed rulesets 2025-08-07 emergency release
+date: 2025-08-07
+---
+
+import { RuleID } from "~/components";
+
+This week’s highlight focuses on two critical vulnerabilities affecting key infrastructure and enterprise content management platforms. Both flaws present significant remote code execution risks that can be exploited with minimal or no user interaction.
+
+**Key Findings**
+
+- Squid (≤6.3) — CVE-2025-54574: A heap buffer overflow occurs when processing Uniform Resource Names (URNs). This vulnerability may allow remote attackers to execute arbitrary code on the server. The issue has been resolved in version 6.4.
+
+- Adobe AEM (≤6.5.23) — CVE-2025-54253: Due to a misconfiguration, attackers can achieve remote code execution without requiring any user interaction, posing a severe threat to affected deployments.
+
+**Impact**
+
+Both vulnerabilities expose critical attack vectors that can lead to full server compromise. The Squid heap buffer overflow allows remote code execution by crafting malicious URNs, which can lead to server takeover or denial of service. Given Squid’s widespread use as a caching proxy, this flaw could be exploited to disrupt network traffic or gain footholds inside secure environments.
+
+Adobe AEM’s remote code execution vulnerability enables attackers to run arbitrary code on the content management server without any user involvement. This puts sensitive content, application integrity, and the underlying infrastructure at extreme risk. Exploitation could lead to data theft, defacement, or persistent backdoor installation.
+
+These findings reinforce the urgency of updating to the patched versions — Squid 6.4 and Adobe AEM 6.5.24 or later — and reviewing configurations to prevent exploitation.
+
+<table style="width: 100%">
+  <thead>
+    <tr>
+      <th>Ruleset</th>
+      <th>Rule ID</th>
+      <th>Legacy Rule ID</th>
+      <th>Description</th>
+      <th>Previous Action</th>
+      <th>New Action</th>
+      <th>Comments</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td>Cloudflare Managed Ruleset</td>
+      <td>
+        <RuleID id="f61ed7c1e7e24c3380289e41ef7e015b" />
+      </td>
+      <td>100844</td>
+      <td>Adobe Experience Manager Forms - Remote Code Execution - CVE:CVE-2025-54253</td>
+      <td>N/A</td>
+      <td>Block</td>
+      <td>This is a New Detection</td>
+    </tr>
+    <tr>
+      <td>Cloudflare Managed Ruleset</td>
+      <td>
+        <RuleID id="e76e65f5a3aa43f49e0684a6baec057a" />
+      </td>
+      <td>100840</td>
+      <td>Squid - Buffer Overflow - CVE:CVE-2025-54574</td>
+      <td>N/A</td>
+      <td>Block</td>
+      <td>This is a New Detection</td>
+    </tr>
+  </tbody>
+</table>