CVE-2009-0468: Multiple cross-site request forgery (CSRF) vulnerabilities in ajax.html in Profense Web Application Firewal...

Security readout for executives and security teams

Profense Web Application Firewall 2.6.2 and 2.6.3 had CSRF flaws that could let an attacker abuse a logged-in administrator’s browser to change appliance settings or shut down the server. This is mainly a risk where legacy Profense administration consoles still exist and admins can be tricked while authenticated. Exposure appears limited to organizations still running Profense Web Application Firewall 2.6.2 or 2.6.3, especially where the management interface is reachable from administrator workstations or broader networks. The affected CPE data in the bundle is incomplete. Treat this as a high-priority legacy exposure check, not a broad emergency. The risk is serious if affected WAF consoles remain in use, because the device protecting applications could be reconfigured or disabled through an administrator’s session. Mitigation focus: Identify any Profense WAF 2.6.2 or 2.6.3 deployments.; Check vendor or successor guidance for fixed builds or retirement instructions.; Restrict management interface access to trusted administrative networks only..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.