Hackers exploit SiteGuard WAF flaw to run commands as root and SYSTEM

Attackers are actively exploiting an OS command injection vulnerability in the SiteGuard Server Edition web application firewall. The flaw allows commands to be run with root or SYSTEM privileges on affected servers.

The issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default. According to the vendor and a warning from Japan's CERT agency, the flaw carries critical severity and is already being abused in the wild.

SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites. Based on WordPress.org statistics, the product runs on 500,000 sites.

"An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed," the company's alert reads.

The attackers' identity, the victims, the scale of the campaign, and the techniques used all remain unclear — neither advisory discloses these details.

Which versions are affected

The vendor lists SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 and later, before 8.00 Update 5, as vulnerable. For Apache httpd and Nginx on FreeBSD, versions 2.20 and later, before 7.00 Update 6, are affected. Exploitation is possible when the statistics function is active. IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected, JPCERT/CC notes.

For installations that cannot be upgraded, the vendor provides a patch that replaces the files used in statistics processing, including for end-of-life versions.

Preserve evidence before patching

The vendor warns that remediation may erase attack traces, so administrators are advised to preserve evidence first. To do so, they should download the "Diagnostic information" from the web management interface (Diagnostic information → Download diagnostic information).

Customers with direct support contracts were notified of the flaw earlier, on September 29.

Source: Bleeping Computer