Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections | Post by Cyber Security News



Tweet

	Cyber Security News ⁦‪@The_Cyber_News‬⁩ ⚠️ Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections Source: cybersecuritynews.com/cloudflare-zer… A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) allowed attackers to bypass security controls and directly access protected pic.x.com/zN6fysUzS2   1/19/26, 11:27 AM

A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF)allowed attackers to bypass security controls and directly access protected origin servers through a certificate validation path.

Security researchers from FearsOff discovered that requests targeting the /.well-known/acme-challenge/ directory could reach origins even when customer-configured WAF rules explicitly blocked all other traffic.

The Automatic Certificate Management Environment (ACME) protocol automates SSL/TLS certificate validation by requiring Certificate Authorities (CAs) to verify domain ownership.