CLAIM-2026-09-28-14
Neither Cloudflare's 24 September 2026 post nor BleepingComputer's 27 September 2026 coverage states that individual affected customers were notified, and neither states that a CVE identifier was assigned.
Why it matters
A documented absence, not a denial. Your assessment has to record what you could not establish and from whom you asked.
Sources
- cloudflare2026how
- bleepingcom2026cloudflar