Skip to content
Cloudflare Docs

2025-05-27

This week’s roundup covers nine vulnerabilities, including six critical RCEs and one dangerous file upload. Affected platforms span cloud services, CI/CD pipelines, CMSs, and enterprise backup systems. Several are now addressed by updated WAF managed rulesets.

Key Findings

  • Ingress-Nginx (CVE-2025-1098): Unauthenticated RCE via unsafe annotation handling. Impacts Kubernetes clusters.
  • GitHub Actions (CVE-2025-30066): RCE through malicious workflow inputs. Targets CI/CD pipelines.
  • Craft CMS (CVE-2025-32432): Template injection enables unauthenticated RCE. High risk to content-heavy sites.
  • F5 BIG-IP (CVE-2025-31644): RCE via TMUI exploit, allowing full system compromise.
  • AJ-Report (CVE-2024-15077): RCE through untrusted template execution. Affects reporting dashboards.
  • NAKIVO Backup (CVE-2024-48248): RCE via insecure script injection. High-value target for ransomware.
  • SAP NetWeaver (CVE-2025-31324): Dangerous file upload flaw enables remote shell deployment.
  • Ivanti EPMM (CVE-2025-4428, 4427): Auth bypass allows full access to mobile device management.
  • Vercel (CVE-2025-32421): Information leak via misconfigured APIs. Useful for attacker recon.

Impact

These newly detected vulnerabilities introduce critical risk across modern web stacks, AI infrastructure, and content platforms: unauthenticated RCEs in Commvault, BentoML, and Craft CMS enable full system compromise with minimal attacker effort.

Apache HTTPD information leak can support targeted reconnaissance, increasing the success rate of follow-up exploits. Organizations using these platforms should prioritize patching and monitor for indicators of exploitation using updated WAF detection rules.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset 100746Vercel - Information DisclosureLogDisabledThis is a New Detection
Cloudflare Managed Ruleset 100754AJ-Report - Remote Code Execution - CVE:CVE-2024-15077LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100756NAKIVO Backup - Remote Code Execution - CVE:CVE-2024-48248LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100757Ingress-Nginx - Remote Code Execution - CVE:CVE-2025-1098LogDisabledThis is a New Detection
Cloudflare Managed Ruleset 100759SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100760Craft CMS - Remote Code Execution - CVE:CVE-2025-32432LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100761GitHub Action - Remote Code Execution - CVE:CVE-2025-30066LogDisabledThis is a New Detection
Cloudflare Managed Ruleset 100762Ivanti EPMM - Auth Bypass - CVE:CVE-2025-4428, CVE:CVE-2025-4427LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100763F5 Big IP - Remote Code Execution - CVE:CVE-2025-31644LogDisabledThis is a New Detection