WAF Rule Set Update Announcement
| Name | waf.sig | ||
| Version | 1.2.61 | ||
| StoneOS Version | 5.5R2-W-1.1 or above, BDS 5.5R8-3.4 or above | ||
| Release Date | 2026-7-27 | New Rules (49) |
Rule ID | Rule Name | Rule Details |
| 1070210577 | CVE-2023-44353: Adobe ColdFusion insecure deserialization exploitation | Click for Details | |
| 1070210578 | CVE-2023-26359: Adobe ColdFusion Insecure Deserialization Exploitation | Click for Details | |
| 1070210579 | CVE-2025-49533: Adobe AEM Forms Insecure Deserialization Exploitation | Click for Details | |
| 1070210580 | CVE-2024-0799: Arcserve UDP Authentication Bypass Exploitation | Click for Details | |
| 1070210581 | AVTECH Surveillance Backend Command Injection Exploitation | Click for Details | |
| 1070210582 | CVE-2026-33980: Azure Data Explorer MCP Server KQL Injection Exploitation | Click for Details | |
| 1070210583 | CVE-2024-21574: ComfyUI-Manager Remote Code Execution Exploitation | Click for Details | |
| 1070210584 | CVE-2025-32432: Craft CMS Remote Code Execution Exploitation | Click for Details | |
| 1070210585 | CVE-2023-41892: Craft CMS Remote Code Execution Exploitation | Click for Details | |
| 1070210586 | CVE-2025-57773: DataEase DB2 JNDI Injection Exploitation | Click for Details | |
| 1070210587 | CVE-2025-46566/CVE-2025-53004/CVE-2025-53005/CVE-2025-53006/CVE-2025-58748: DataEase Dangerous JDBC Factory Remote Code Execution Exploitation | Click for Details | |
| 1070210588 | CVE-2026-32140: DataEase Redshift JDBC IniFile Configuration Loading Attempt | Click for Details | |
| 1070210589 | CVE-2023-4542: D-Link DAR-8000-10 Command Injection Exploitation | Click for Details | |
| 1070210590 | CVE-2024-3273: D-Link NAS Nas_sharing.cgi Command Injection Exploitation | Click for Details | |
| 1070210591 | CVE-2026-22666: Dolibarr ERP CRM Remote Code Execution Exploitation | Click for Details | |
| 1070210592 | CVE-2026-44581: Next.js CSP Nonce Parsing Cross-site Scripting Exploitation | Click for Details | |
| 1070210593 | CVE-2026-22241: Open EClass Theme Archive PHP File Upload Exploitation | Click for Details | |
| 1070210594 | CVE-2024-41667: OpenAM FreeMarker Template Injection Remote Code Execution Exploitation | Click for Details | |
| 1070210595 | CVE-2024-9463: Palo Alto Networks Expedition Command Injection Exploitation | Click for Details | |
| 1070210596 | CVE-2017-15944: Palo Alto Networks Firewall Command Injection Exploitation | Click for Details | |
| 1070210597 | CVE-2019-1579: PAN-OS Sslmgr Format String Command Execution Exploitation | Click for Details | |
| 1070210598 | CVE-2026-41679: Paperclip Process Adapter Import Authorization Weakness Activity | Click for Details | |
| 1070210599 | CVE-2022-32417: PbootCMS Template Tag Remote Command Execution Exploitation | Click for Details | |
| 1070210600 | CVE-2024-2044: PgAdmin Malicious Pickle Deserialization Code Execution Exploitation | Click for Details | |
| 1070210601 | PHP 8.1.0-dev Backdoor Command Execution Exploitation | Click for Details | |
| 1070210602 | PHPCMS 9.6.0 Arbitrary PHP File Upload Exploitation | Click for Details | |
| 1070210603 | CVE-2020-24949: PHP-Fusion Template Command Injection Exploitation | Click for Details | |
| 1070210604 | phpStudy Accept-Charset Backdoor Command Execution Exploitation | Click for Details | |
| 1070210605 | CVE-2024-1212: Progress Kemp LoadMaster Command Injection Exploitation | Click for Details | |
| 1070210606 | CVE-2024-21645: PyLoad Log Injection Exploitation | Click for Details | |
| 1070210607 | CVE-2023-47218: QNAP QTS and QuTS Hero Command Injection Exploitation | Click for Details | |
| 1070210608 | CVE-2026-41176: Rclone Access Control Weakening Configuration Activity | Click for Details | |
| 1070210609 | CVE-2018-14667: RichFaces UserResource Deserialization Exploitation | Click for Details | |
| 1070210610 | CVE-2025-34300: Sawtooth Lighthouse Studio Template Injection Command Execution Exploitation | Click for Details | |
| 1070210611 | SeaCMS 5.45, 5.54, 5.55 and 6.54 Search Template Code Injection Exploitation | Click for Details | |
| 1070210612 | CVE-2020-1147: Microsoft SharePoint DataSet Deserialization Remote Code Execution Exploitation | Click for Details | |
| 1070210613 | CVE-2023-35813: Sitecore XAML Server Control Injection Remote Code Execution Exploitation | Click for Details | |
| 1070210614 | MySQL JDBC Auto-deserialization Interceptor Injection Exploitation | Click for Details | |
| 1070210615 | CVE-2018-15910: Ghostscript Sandbox Bypass Command Execution Exploitation | Click for Details | |
| 1070210616 | Horde Groupware Webmail Edition Remote Code Execution Exploitation | Click for Details | |
| 1070210617 | CVE-2017-12542: HP Integrated Lights-Out 4 Authentication Bypass Exploitation | Click for Details | |
| 1070210618 | CVE-2024-21893: Ivanti Connect Secure SAML SSRF and Command Injection Chain Exploitation | Click for Details | |
| 1070210619 | Dangerous Java Expression JNDI and XML Application Context Injection Exploitation | Click for Details | |
| 1070210620 | MeterSphere DebugSampler Custom Method Remote Command Execution Exploitation | Click for Details | |
| 1070210621 | CVE-2022-40022: Microchip SyncServer S650 Command Injection Exploitation | Click for Details | |
| 1070210622 | CVE-2020-16875: Microsoft Exchange Server DLP Policy Remote Code Execution Exploitation | Click for Details | |
| 1070210623 | CVE-2021-20837: Movable Type XML-RPC Remote Command Execution Exploitation | Click for Details | |
| 1070210624 | Detects Fastjson JSONType Class Loading Attacks | Click for Details | |
| 1070210625 | CDG Server3 Remote Code Execution | Click for Details | |