Fastly WAF returning 406 during CSV import in Adobe Commerce Cloud
The 406 happened because bots had injected SQL injection patterns into search terms that passed character validation; Fastly WAF blocked the CSV.
The first clue was the 406 status during search-term import. The application saw a valid file, but the WAF recognized SQL injection patterns in its contents.
The fix was cleaning the contaminated data and making validation stricter before import. Disabling the WAF would only hide the problem.
