INCIDENT REPORT · CP-2025-022

Cloudflare global network outage

L3 · ELEVATEDCONFIRMEDNOT AN ATTACK

A database permissions change caused Cloudflare's Bot Management feature file to double in size, crashing core proxy software across its global network; Cloudflare said it was not a cyberattack.

Incident ID: CP-2025-022
Incident date: 18 NOV 2025
Detection date: 18 NOV 2025
Affected countries: United States
Plotted location: San Francisco, United States (Affected organization headquarters (global network))
Threat classification: Level 3 — ELEVATED
Classification rationale: Global internet-scale disruption lasting several hours; not malicious.
Attack type: Non-Malicious IT Failure
Nature: Non-malicious failure — not a cyberattack
Attack vector: Not publicly documented
Sectors: Technology, Media, Finance
Critical infrastructure: Yes
Organizations affected: Cloudflare, Many websites and services using Cloudflare
Operational consequences: Core traffic delivery failed from about 11:20 UTC, was largely restored by 14:30 UTC, and all systems were normal by 17:06 UTC, disrupting a large share of websites and online services globally.
Estimated financial impact: No reliably documented figure
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Cloudflare global network outage

L3 · ELEVATEDCONFIRMEDNOT AN ATTACK

A database permissions change caused Cloudflare's Bot Management feature file to double in size, crashing core proxy software across its global network; Cloudflare said it was not a cyberattack.

Incident ID

CP-2025-022

Incident date

18 NOV 2025

Detection date

18 NOV 2025

Affected countries

United States

Plotted location

San Francisco, United States (Affected organization headquarters (global network))

Threat classification

Level 3 — ELEVATED

Classification rationale

Global internet-scale disruption lasting several hours; not malicious.

Attack type

Non-Malicious IT Failure

Nature

Non-malicious failure — not a cyberattack

Attack vector

Not publicly documented

Sectors

Technology, Media, Finance

Critical infrastructure

Yes

Organizations affected

Cloudflare, Many websites and services using Cloudflare

Operational consequences

Core traffic delivery failed from about 11:20 UTC, was largely restored by 14:30 UTC, and all systems were normal by 17:06 UTC, disrupting a large share of websites and online services globally.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded