Multiple ModSecurity Vulnerabilities Allow Attackers to Bypass Firewall Rules

Cybersecuritynews •Abinaya • July 6, 2026

Multiple vulnerabilities have been disclosed in OWASP ModSecurity, a widely used open-source web application firewall (WAF), allowing attackers to bypass security rules under specific conditions. The flaws, tracked as CVE-2026-52761 and CVE-2026-52747, affect ModSecurity versions up to 3.0.15 and have been addressed in version 3.0.16. The first issue, CVE-2026-52761, is a moderate-severity flaw that impacts […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ModSecurity Vulnerabilities Allow WAF Rule Evasion ModSecurity, an open-source web application firewall, has multiple vulnerabilities (CVE-2026-52761 and CVE-2026-52747) that enable attackers to bypass security rules through specially crafted HTTP requests. These flaws affect versions up to 3.0.15 and were addressed in version 3.0.16. The vulnerabilities stem from inconsistencies in input transformation and request parsing, posing a risk to web applications relying on this firewall for security. Users are advised to upgrade to the latest version to mitigate potential exploitation. The flaws have been classified as moderate severity, indicating a significant but not critical risk. 2 sources 58

Extracted Entities

CVEs (2)

CVE-2026-52747 CVE-2026-52761

Platforms (1)

ModSecurity