{
  "build_datetime": "2026-11-08T22:58:47Z",
  "rulesets": [
    {
      "id": "edgeguard-cve",
      "name": "EdgeGuard CVE Virtual Patches",
      "version": "1",
      "source": "edgeguard-cve",
      "description": "Virtual patches for named vulnerabilities",
      "enabled": true,
      "priority": 1,
      "rules": [
        {
          "id": "CVE-2016-3081-M1",
          "name": "Apache Struts S2-032 - OGNL execution via the method: prefix",
          "pattern": "(?i)method:#_memberAccess=@ognl\\.OgnlContext@DEFAULT_MEMBER_ACCESS",
          "targets": [
            "uri",
            "query",
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2016-3081",
          "enabled": true,
          "references": [
            "https://cwiki.apache.org/confluence/display/WW/S2-032",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-3081"
          ],
          "origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"\u0026cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does."
        },
        {
          "id": "CVE-2017-9841-N1",
          "name": "PHPUnit - Remote Code Execution",
          "pattern": "(?i)/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin\\.php",
          "targets": [
            "uri"
          ],
          "action": "block",
          "severity": "critical",
          "category": "cve",
          "cve": "CVE-2017-9841",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer, then promoted to block by hand. Its path is a file that should never be web-reachable, so a request for it is the attack and there is nothing legitimate to refuse. The other rules in this channel carry action \"log\": the engine records those and adds nothing to the anomaly score, so they cannot refuse anything on their own."
        },
        {
          "id": "CVE-2026-0770-N1",
          "name": "Langflow \u003c 1.3.0 - Remote Code Execution via validate_code() exec()",
          "pattern": "(?i)\\{\"code\":\"\\\\ndef exploit\\(\\\\n    _=\\( lambda r: \\(_ for _ in \\(\\)\\)\\.throw\\(Exception\\(f\\\\\"OUTPUT:\\\\\\\\n\\{r\\.stdout\\}\\{r\\.stderr\\}\\\\\"\\)\\) \\)\\(\\\\n        __import__\\('subprocess'\\)\\.run\\('cat /etc/passwd', shell=True, capture_output=",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-0770",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-0770",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-0770.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-104935-N1",
          "name": "Ivanti Connect Secure \u003c= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",
          "pattern": "(?i)X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu\\.cgi",
          "targets": [
            "headers"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-104935",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-104935",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-104935.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-105134-N1",
          "name": "AhsayCBS \u003c= 10.3.4 - Unauthenticated RCE",
          "pattern": "(?i)\\.\\./\\.\\./webapps/rps\"\\)\\}\\}",
          "targets": [
            "headers"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-105134",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-105134",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-105134.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-10520-N1",
          "name": "Ivanti Sentry - OS Command Injection",
          "pattern": "(?i)message=execute system /configuration/system/commandexec \u003ccommandexec\u003e\u003cindex\u003e1\u003c/index\u003e\u003creqandres\u003eecho",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-10520",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-10520",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-10520.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-110447-N1",
          "name": "Collabora Built-in CODE Server \u003c 26.4.303 - OS Command Injection",
          "pattern": "(?i)/\\.\\./apps/richdocumentscode_arm64/proxy\\.php",
          "targets": [
            "uri"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-110447",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-110447.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-21589-N1",
          "name": "Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read",
          "pattern": "(?i)/1\\.0/_/download/resources/com\\.atlassian\\.bitbucket\\.server\\.bitbucket-webpack-INTERNAL:avatar/avatar/\\.\\.::\\.\\.::\\.\\.::\\.\\.::\\.\\.::WEB-INF::urlrewrite\\.xml",
          "targets": [
            "uri"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-21589",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-21589.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-34908-N1",
          "name": "UniFi OS - Authentication Bypass via Path Traversal (..%2f)",
          "pattern": "(?i)/auth/validate-sso/\\.\\./\\.\\./\\.\\./proxy/users/api/v2/ucs/update/latest_package",
          "targets": [
            "uri"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-34908",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-34908",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34908.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-63077-N1",
          "name": "JetBrains TeamCity \u003c 2026.1.3, 2025.11.7 - Remote Code Execution",
          "pattern": "(?i)\\.jspws'\u003c/string\u003e\u003c/connectionInitSqls\u003e\u003caccessToUnderlyingConnectionAllowed\u003efalse\u003c/accessToUnderlyingConnectionAllowed\u003e\u003cmaxConnLifetimeMillis\u003e-1\u003c/maxConnLifetimeMillis\u003e\u003clogExpiredConnections\u003etrue\u003c/logEx",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-63077",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-63077",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-63077.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-72898-N1",
          "name": "Metabase - Unauthenticated SQL Injection",
          "pattern": "(?i)Aa1!\",\"user-id\":\\{\"select\":\\[\"id\"\\],\"from\":\\[\"core_user\"\\],\"where\":\\[\"=\",\"is_superuser\",true\\],\"limit\":1\\}\\}",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-72898",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-72898",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-72898.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-75650-N1",
          "name": "Adobe Commerce/Magento \u003c= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI",
          "pattern": "(?i)text=\\{\\{block class=Magento\\\\Backend\\\\Block\\\\Widget\\\\Grid\\\\ColumnSet rowUrl=\\$this\\.template_styles cache_key=y\\}\\}",
          "targets": [
            "query"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-75650",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-75650",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-75650.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-8037-N1",
          "name": "Progress ADC LoadMaster - Command Injection",
          "pattern": "(?i)\\{\"cmd\": \"getall\", \"apiuser\": \"''''\", \"apipass\": \"BBBBB\", \"g0\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g1\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g2\": \"AAAAAAAAAAAAAAAA'; cat /etc/passwd #\", \"g3\":",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-8037",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-8037",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-8037.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-87902-N1",
          "name": "WordPress Core - PHP Template Path Traversal",
          "pattern": "(?i)pagename=templates/\\.\\./\\.\\./\\.\\./\\.\\./wp-includes/theme-compat/footer",
          "targets": [
            "query"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-87902",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-87902.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-93616-N1",
          "name": "Check Point Security Management - Unauthenticated Directory Traversal to RCE",
          "pattern": "(?i)\u003c\\?xml version=\"1\\.0\"\\?\u003e\u003csoap:Envelope xmlns:soap=\"http://schemas\\.xmlsoap\\.org/soap/envelope/\"\u003e\u003csoap:Body\u003e\u003cloginAsApplicationReadOnlyPublicSession xmlns=\"http://www\\.checkpoint\\.com/DleWebService/UpgradeSvc",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-93616",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-93616",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-93616.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        },
        {
          "id": "CVE-2026-9586-N1",
          "name": "Sangoma Switchvox \u003c 8.4.0.2 - Unauthenticated SQL Injection",
          "pattern": "(?i)\u003crequest\u003e\u003cPhoneIP\u003e10\\.0\\.0\\.1'; COPY \\(SELECT ''\\) TO PROGRAM 'nslookup",
          "targets": [
            "body"
          ],
          "action": "log",
          "severity": "high",
          "category": "cve",
          "cve": "CVE-2026-9586",
          "enabled": true,
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-9586",
            "https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-9586.yaml"
          ],
          "origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
        }
      ]
    }
  ]
}