Virtual patches for CVEs
- English
- 日本語
To help protect your web application against Common Vulnerabilities and Exposures (CVE), you can enable virtual patches. A virtual patch is a pre-constructed rule that targets a specific CVE. Once enabled, requests that meet the virtual patch's criteria are tagged with the appropriate CVE signal and then blocked or logged per your enablement specification. We announce new virtual patches through our changelog guide.
Enabling virtual patches using the Fastly control panel
From the Fastly control panel, you can enable CVE virtual patches from the Signals page and from workspace settings.
- Signals page
- Workspace settings
- Log in to the Fastly control panel.
- Go to Security > Next-Gen WAF > Signals.
- From the workspaces bar, click the menu
to the right of the workspace name and select a workspace. - Click the Virtual Patches tab.
- Click the name of the virtual patch that you want to enable.
- Click Configuration and then Detections.
- Click the Status switch to the On position. Fastly tags and logs all requests matching the signal's criteria.
- Click the Thresholds tab.
- Click the Immediate blocking switch to the On position to immediately block all requests tagged with the virtual patch signal. Leave the switch in the Off position if you only want to log the requests.
- Log in to the Fastly control panel.
- Go to Security > Next-Gen WAF > Workspaces.
- Click the gear
next to the workspace that you want to modify. Click Virtual patches.
Use the search bar to find the virtual patch you want to apply, and then make the following changes inline:
- If your workspace is in blocking mode, from the Mode menu, leave Log selected to immediately log requests when the signal is observed or select Block to immediately block requests when the signal is observed.
- Click the Status switch to the ON position.
Working with virtual patches using the Next-Gen WAF control panel
From the Next-Gen WAF control panel, you can enable virtual patches and subscribe to virtual patch release notifications.
Enabling virtual patches
The steps to enable a CVE virtual patch depend on the platform or packaged offering that you've purchased.
- Professional and Premier platforms or packaged offerings
- Essential platform
If you're on the Professional or Premier platform or have purchased the Security Core, Security Core Plus, or Security Total packaged offering, complete the following steps:
- Log in to the Next-Gen WAF control panel.
- From the Sites menu, select a site if you have more than one site.
- From the Rules menu, select Templated Rules.
- Click View to the right of the virtual patch rule you want to enable or edit.
- Click Configure and then Add trigger.
- Select the Block requests from an IP immediately if the CVE-YYYY-NNNNN signal is observed checkbox.
- Click Update rule.
If you're on the Essential platform, complete the following steps:
- Log in to the Next-Gen WAF control panel.
- From the Sites menu, select a site if you have more than one site.
Click the Signals tab.
Click View in the row of the CVE signal that you want to enable.
Click the Detections tab and then Add detection.
Verify the switch is set to Enabled.
Click Create detection.
Click the Alerts tab and then Add alert.
In the Status area, set the switch to Enabled.
Click Save alert.
Subscribing to virtual patch announcements
To receive an email when we release a new virtual patch, complete the following steps using the Next-Gen WAF control panel:
- Log in to the Next-Gen WAF control panel.
- From the corp navigation bar, click My Profile.
- In the Corp subscriptions section, select the Alert me when a new Virtual Patch for a CVE is available checkbox.
