Configuration oversights can still be leveraged in attacks - despite costly WAFs protecting the infrastructure.