Skip to content
Cloudflare Docs

2025-05-27

This week’s roundup covers nine vulnerabilities, including six critical RCEs and one dangerous file upload. Affected platforms span cloud services, CI/CD pipelines, CMSs, and enterprise backup systems. Several are now addressed by updated WAF managed rulesets.

Key Findings

  • Ingress-Nginx (CVE-2025-1098): Unauthenticated RCE via unsafe annotation handling. Impacts Kubernetes clusters.
  • GitHub Actions (CVE-2025-30066): RCE through malicious workflow inputs. Targets CI/CD pipelines.
  • Craft CMS (CVE-2025-32432): Template injection enables unauthenticated RCE. High risk to content-heavy sites.
  • F5 BIG-IP (CVE-2025-31644): RCE via TMUI exploit, allowing full system compromise.
  • AJ-Report (CVE-2024-15077): RCE through untrusted template execution. Affects reporting dashboards.
  • NAKIVO Backup (CVE-2024-48248): RCE via insecure script injection. High-value target for ransomware.
  • SAP NetWeaver (CVE-2025-31324): Dangerous file upload flaw enables remote shell deployment.
  • Ivanti EPMM (CVE-2025-4428, 4427): Auth bypass allows full access to mobile device management.
  • Vercel (CVE-2025-32421): Information leak via misconfigured APIs. Useful for attacker recon.

Impact

These vulnerabilities expose critical components across Kubernetes, CI/CD pipelines, and enterprise systems to severe threats including unauthenticated remote code execution, authentication bypass, and information leaks. High-impact flaws in Ingress-Nginx, Craft CMS, F5 BIG-IP, and NAKIVO Backup enable full system compromise, while SAP NetWeaver and AJ-Report allow remote shell deployment and template-based attacks. Ivanti EPMM’s auth bypass further risks unauthorized control over mobile device fleets.

GitHub Actions and Vercel introduce supply chain and reconnaissance risks, allowing malicious workflow inputs and data exposure that aid in targeted exploitation. Organizations should prioritize immediate patching, enhance monitoring, and deploy updated WAF and IDS signatures to defend against likely active exploitation.

RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed Ruleset 100746Vercel - Information DisclosureLogDisabledThis is a New Detection
Cloudflare Managed Ruleset 100754AJ-Report - Remote Code Execution - CVE:CVE-2024-15077LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100756NAKIVO Backup - Remote Code Execution - CVE:CVE-2024-48248LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100757Ingress-Nginx - Remote Code Execution - CVE:CVE-2025-1098LogDisabledThis is a New Detection
Cloudflare Managed Ruleset 100759SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100760Craft CMS - Remote Code Execution - CVE:CVE-2025-32432LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100761GitHub Action - Remote Code Execution - CVE:CVE-2025-30066LogDisabledThis is a New Detection
Cloudflare Managed Ruleset 100762Ivanti EPMM - Auth Bypass - CVE:CVE-2025-4428, CVE:CVE-2025-4427LogBlockThis is a New Detection
Cloudflare Managed Ruleset 100763F5 Big IP - Remote Code Execution - CVE:CVE-2025-31644LogDisabledThis is a New Detection