Understanding Atomicorp WAF Protection Status

These are the protection terms used throughout our CVE research notes. Keep your Atomicorp rules current, and apply vendor security updates. The absence of a CVE article does not imply the absence of protection.

Protected by Atomicorp rules

Atomicorp ModSecurity rules block attacks exploiting this vulnerability. Keep your rules current.

Already protected by existing Atomicorp rules

Your current Atomicorp rules already provide the applicable protection. No new CVE-specific rule required. Keep your rules current and apply vendor security updates. This finding can be established through testing or engineering review.

Detected by Atomicorp rules

Atomicorp rules detect activity associated with this vulnerability. This finding describes detection; it does not claim that the request was blocked.

Atomicorp rules identified for this CVE

Atomicorp research identifies rules relevant to this vulnerability. This finding describes a documented association and does not by itself establish current blocking protection.

Vulnerability risk and protection

CVSS severity, FIRST EPSS exploitation probability, CISA KEV status and attack requirements describe the vulnerability. Atomicorp protection is shown separately; it does not change the published CVSS or EPSS score. EPSS estimates exploitation in the next 30 days and is shown with its score date when available. Absence from KEV does not establish that exploitation has never occurred.

Selected Rule IDs observed

These are the applicable Atomicorp rule identifiers associated with the research finding. Other Atomicorp rules may also protect against the same attack behavior.

Protection beyond individual CVEs

Atomicorp rules target underlying attack techniques and CWE weakness classes. Existing protections can therefore apply to newly disclosed vulnerabilities without requiring a new rule for each CVE. Rule changes are regression-tested against attack and false-positive corpora.

These notes publish selected positive research findings. They are not an exhaustive protection matrix. Keep software patched as part of a defense-in-depth security program.