WAF benchmark
A real attack payload for 482 exploited CVEs, plus common WAF-evasion variants of each, sent through every vendor's WAF in front of our own test server. Measured, not claimed.
- CloudflareEnterprise, tunedEnterprise defaults (Managed + OWASP Core Ruleset) plus a WAF attack-score block (cf.waf.score < 40), how a security-tuned Enterprise zone is run · real payloads + evasion variants171 blocked101 partly209 passed36%blocked±5 ptsThis is Vigilbase's Managed Cloudflare. The top score here is a Cloudflare Enterprise zone we set up and tune — the attack-score rule, the managed rules, the lot. We run it for you.Managed Cloudflare
- AWSAll free managed rulesEvery free AWS managed rule group at default actions: Core, Known bad inputs, SQLi, Linux, POSIX, Windows, PHP, WordPress · real payloads + evasion variants166 blocked79 partly235 passed35%blocked±5 pts
- Google CloudPreconfigured WAF rulesGlobal external ALB, 13 preconfigured rules (v33 sets + cve-canary) at sensitivity 1, deny-403 · real payloads + evasion variants158 blocked101 partly223 passed2 false positives33%blocked±4 pts
- 4CloudflareEnterpriseManaged Ruleset + OWASP Core Ruleset (PL1, high sensitivity), Bot Management, BIC on; one managed rule skipped on /api/* · real payloads + evasion variants147 blocked88 partly246 passed31%blocked±4 pts
- 5AWSBaseline managed rulesAWS managed rule groups at default actions: Core rule set + Known bad inputs. Regional web ACL on API Gateway (us-east-1) · real payloads + evasion variants101 blocked64 partly315 passed21%blocked±4 pts
- 6CloudflareFreeFree plan defaults: Free Managed Ruleset, Browser Integrity Check on, no custom rules for this host · real payloads + evasion variants13 blocked9 partly458 passed3%blocked±2 pts
- 7VercelPro, defaultsPro project at firewall defaults, no custom rules or managed rulesets; runner IP exempt from IP-level blocking (system bypass) · real payloads + evasion variantsVercel’s defaults only. Its OWASP Core Ruleset is Enterprise-only and not tested here. Our runner’s IP is exempt from Vercel’s IP-level blocking (system bypass), which may also skip the rules Vercel deploys for specific CVEs. Vercel has not confirmed either way.7 blocked6 partly466 passed1%blocked±1 pts
Nothing filtering: the baseline
The same requests through a plain CDN with no WAF product in front of the same server. 473 of 481 CVEs reached it untouched. The 8 stopped here were refused by the CDN itself as malformed (bad encoding, request smuggling): any edge refuses those, so they say nothing about a WAF.
- Blocked 5
- Partly 3
- Passed 473
By type of attack
The overall score hides where each WAF is strong and where it is blind. Each cell is the share of that attack type's CVEs the WAF fully blocked.
| Attack type | CloudflareEnterprise, tuned | AWSAll free managed rules | Google CloudPreconfigured WAF rules | CloudflareEnterprise | AWSBaseline managed rules | CloudflareFree | VercelPro, defaults |
|---|---|---|---|---|---|---|---|
Code & command injection 122 CVEs · Running code or shell commands on the server (OGNL, Log4j, template and expression injection, PHP code). | 36% | 43% | 36% | 34% | 14% | 2% | 0% |
Path traversal & file inclusion 63 CVEs · Reading or including files outside the web root with ../ sequences and encodings. | 53% | 55% | 56% | 34% | 37% | 5% | 5% |
Insecure deserialization 34 CVEs · Unsafe object deserialization that leads to code execution. | 38% | 29% | 26% | 35% | 26% | 3% | 3% |
SQL & other injection 24 CVEs · SQL injection, XXE and other injection into a parser or interpreter. | 54% | 42% | 46% | 46% | 25% | 4% | 0% |
Server-side request forgery 17 CVEs · Making the server send requests to places it should not reach. | 35% | 24% | 18% | 29% | 24% | 0% | 0% |
Cross-site scripting 11 CVEs · Injecting script that runs in a visitor’s browser. | 18% | 18% | 18% | 18% | 18% | 0% | 0% |
Dangerous file upload 11 CVEs · Uploading a web shell or executable file. | 9% | 0% | 18% | 9% | 0% | 9% | 0% |
Auth bypass & access control 111 CVEs · Reaching functions or data without the right authentication or authorization. | 30% | 22% | 21% | 28% | 16% | 1% | 2% |
Input & request handling 26 CVEs · Improper input validation, request smuggling and response splitting. | 50% | 46% | 46% | 50% | 35% | 8% | 0% |
Other 66 CVEs · Memory-safety, logic and other CVEs without a web-request class. | 20% | 28% | 26% | 16% | 22% | 2% | 2% |
Attack type comes from each CVE's CWE (e.g. CWE-78 → command injection). Types with fewer than 8 CVEs are folded into Other, so no cell rests on a handful of CVEs.
Over time
Each WAF's fully-blocked rate per daily run. A jump usually means a vendor shipped or changed a rule.
- Cloudflare · Enterprise, tuned
- AWS · All free managed rules
- Google Cloud · Preconfigured WAF rules
- Cloudflare · Enterprise
- AWS · Baseline managed rules
- Cloudflare · Free
- Vercel · Pro, defaults
Data table
| WAF | 2 Nov | 3 Nov | 4 Nov | 5 Nov | 6 Nov |
|---|---|---|---|---|---|
| Cloudflare · Enterprise, tuned | — | 35% | 35% | 36% | 36% |
| AWS · All free managed rules | 36% | 35% | 35% | 35% | 35% |
| Google Cloud · Preconfigured WAF rules | 35% | 33% | 33% | 33% | 33% |
| Cloudflare · Enterprise | 32% | 31% | 31% | 31% | 31% |
| AWS · Baseline managed rules | 25% | 21% | 21% | 21% | 21% |
| Cloudflare · Free | 3% | 3% | 3% | 3% | 3% |
| Vercel · Pro, defaults | — | — | 1% | 1% | 1% |
How sure we are
Each number is measured, but read it as a range, and with what the test can and can't see.
Each score is ±5 points
About 482 CVEs per target gives a 95% range of up to ±5 percentage points around each score (shown as "likely" on each card).
100.0% repeatable
Run again, 3,363 of 3,363 CVE verdicts came out the same. No WAF changed a single verdict.
Head to head, on the same CVEs
- Cloudflare · Enterprise, tuned vs AWS · All free managed rules56 vs 51 CVEs only one of them blockedCould be chance
- AWS · All free managed rules vs Google Cloud · Preconfigured WAF rules32 vs 24 CVEs only one of them blockedCould be chance
- Google Cloud · Preconfigured WAF rules vs Cloudflare · Enterprise64 vs 53 CVEs only one of them blockedCould be chance
- Cloudflare · Enterprise vs AWS · Baseline managed rules86 vs 40 CVEs only one of them blockedReal difference
- AWS · Baseline managed rules vs Cloudflare · Free91 vs 3 CVEs only one of them blockedReal difference
- Cloudflare · Free vs Vercel · Pro, defaults9 vs 4 CVEs only one of them blockedCould be chance
Exact McNemar test on the CVEs where they disagree; "real difference" means under a 5% chance of a split that uneven if both blocked equally often.
What this measures, and what it can't
- We send a real attack payload per CVE, then the same attack again under common WAF evasions: double URL-encoding, overlong UTF-8, nested Log4j lookups, SQL inline comments, mixed case. A CVE counts as blocked only if the edge stopped every variant; one that slips through is logged with the technique that worked. Where a nuclei template only proves a bug harmlessly (
echo … | rev,16*8787), we swap in the real command or gadget first. - This no longer favours broad generic rules over precise CVE signatures: a vendor's per-CVE rule now sees the payload it was written for. Cloudflare names 88 of these CVEs in its changelog and still didn't fully block 47; AWS names 5 of these CVEs in its changelog and still didn't fully block 3; Google Cloud names 5 of these CVEs in its changelog and still didn't fully block 0; Vercel names 3 of these CVEs in its changelog and still didn't fully block 3.
- We send over HTTPS to our own inert origin, which runs nothing and serves a static response, so no payload is ever executed and nothing is republished. Payloads never carry a callback to live infrastructure; a Log4j lookup keeps the template's own sinkhole host.
- 132 CVEs got past every WAF. Their requests look like ordinary traffic even weaponised, so they say little about any one vendor.
- Defaults only, from one region (us-east-1), once a day. Cloudflare Enterprise runs its Managed Ruleset as shipped; on 3 November 2026 about a third of its rules were off by default, and switching all of them on would have changed only 4 of these CVEs.
Says it blocks, didn't block
The vendor's changelog lists a rule for the CVE that blocks by default, yet the real exploit payload (and every evasion variant) reached our server on every configuration we test.
Where they disagree
345 of 482 CVEs: at least one configuration stopped the exploit and another let it through.
- Blocked
- Partly blocked
- Got through
- Ring: vendor names this CVE in its changelog
How we test
- Same attack for everyone. Each CVE's exploit request from nuclei-templates, with any harmless proof-of-concept marker swapped for the real payload, built byte for byte the same way for every target. Then the same attack again under common evasions (double-encoding, overlong UTF-8, nested Log4j lookups, SQL comments, parameter pollution, mixed case). Plus about 30 ordinary requests to count false positives.
- Our own server, nothing vulnerable. Every WAF sits in front of the same origin, which runs nothing, executes nothing and marks every response it serves. Real payloads are inert there. A response without that mark came from the WAF; blocked, challenged or refused by the edge counts as stopped.
- Defaults, plus one tuned zone. Each target lists exactly what is switched on. Every vendor runs as shipped, with nothing tuned for the test. The one exception is labelled: Cloudflare Enterprise, tuned, which adds a WAF attack-score block, the way a security team would run it.
- Polite and contained. One request per second per target, a few thousand a day, only to hostnames we run, with no callback to any live infrastructure. Payloads are never republished on this site: results show only the technique and the path.
- Reproducible. The request list, templates commit and every target's configuration are in the JSON.
- Who runs it. Vigilbase. We are a Cloudflare partner and sell managed Cloudflare, so treat our reading with that in mind and check the raw results. Vendors can send us a configuration they'd rather we test.
Defaults leave gaps
Every configuration above misses some exploited CVEs. Tuning and watching the WAF closes them.
Managed Cloudflare WAF on a monthly plan.
Managed Cloudflare WAF and DDoS protection on a monthly plan, run by our team.
See Shield plansCloudflare Enterprise, run and tuned by Vigilbase.
Cloudflare Enterprise licensing, with Vigilbase running the account: changes, tuning and verification.
Managed CloudflareKnow the day a CVE like these reaches your stack.
Connects the security tools you already pay for. Vigil investigates, makes the fixes you authorise and verifies them.
Get started