Attackers Exploit SiteGuard WAF Command Injection Flaw for Root Access

Hackers are actively exploiting a command injection vulnerability in SiteGuard Server Edition, a popular web application firewall, according to BleepingComputer. This flaw allows attackers to execute arbitrary operating system commands with root or SYSTEM privileges on compromised servers. The security issue is tracked as CVE-2026-106931 and affects the statistics feature, which is enabled by default on many installations.

SiteGuard’s advisory confirms that abuse of CVE-2026-106931 has already been detected in the wild, according to the vendor’s bulletin. Japan’s CERT agency, JPCERT/CC, also issued a warning regarding the critical severity of the vulnerability. While the specific identity of the attackers, the number of victims, and the exact attack methods remain unclear, the confirmation of active exploitation underscores the immediate risk to administrators using the software.

Context and Background

SiteGuard is a leading Japanese vendor that claims to protect more than 1.5 million websites globally. Based on statistics from WordPress.org, the product is currently active on approximately 500,000 sites. The vulnerability resides within the statistics function of host-based WAF instances. Because this feature is enabled by default, many deployments may be exposed without administrators realizing the configuration risk associated with CVE-2026-106931.

Who Is Affected

According to the vendor, SiteGuard Server Edition for Apache httpd, Nginx, and IIS versions 2.20 and later, up to but not including 8.00 Update 5, are vulnerable. This exclusion applies to FreeBSD versions. For FreeBSD installations running Apache httpd or Nginx, versions 2.20 and later before 7.00 Update 6 are affected. JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4 are not impacted by this specific flaw.

Administrators should note that successful exploitation requires the statistics function to be active. The vendor warns that applying the remediation may erase evidence of prior attacks. Therefore, they recommend preserving forensic data by downloading diagnostic information from the web management interface before patching or updating the system. Customers with direct support contracts were notified of the issue on September 29.

What should you do?

Administrators should verify their current SiteGuard Server Edition version against the vulnerable ranges listed above. If running an affected version, prioritize updating to the latest stable release or applying the vendor’s provided patch. For environments where immediate updates are not possible, review access logs for signs of unauthorized command execution. Ensure diagnostic data is retained for forensic analysis before any remediation steps are taken.

What to do and how to stay safe: SiteGuard

• Check your SiteGuard Server Edition version to determine if it falls within the vulnerable range for your specific operating system and web server.
• Download and save diagnostic information from the web management interface to preserve potential evidence of compromise before applying any patches.
• Apply the vendor’s recommended update or patch as soon as possible to mitigate the risk of remote command execution.
• Monitor server logs for unusual activity or unauthorized commands, particularly those originating from or targeting the statistics function.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is my SiteGuard installation vulnerable to CVE-2026-106931?

If you are running SiteGuard Server Edition versions 2.20 or later, before 8.00 Update 5 on Apache, Nginx, or IIS, or before 7.00 Update 6 on FreeBSD with Apache or Nginx, you are likely affected.

Are there any versions of SiteGuard that are not affected?

JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4 are not affected by this vulnerability.

Does the vendor provide a fix for end-of-life versions?

Yes, the vendor offers a patch that replaces specific files used in statistics processing, including support for some end-of-life versions of the product.