Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Attackers are exploiting SiteGuard WAF flaw CVE-2026-106931 to run commands as root or SYSTEM.
Attackers are exploiting CVE-2026-106931, a critical OS command-injection flaw in SiteGuard Server Edition's statistics function, which is enabled by default. Successful attacks can run commands as root or SYSTEM on vulnerable Apache, Nginx, and IIS installations. SiteGuard, which says it protects more than 1.5 million websites, and JPCERT/CC confirm abuse, though attacker identity, victims, and scale are unknown. Fixed releases and a file-replacement patch are available, and administrators are told to save diagnostic information before remediation.
- CVE-2026-106931 is OS command injection in the default statistics feature.
- Vulnerable builds include Apache, Nginx, and IIS editions before the listed updates.
- SiteGuard and JPCERT/CC confirm exploitation, but victims and scale are unknown.
- A patch or file replacement is available; preserve diagnostics before updating.
Vulnerabilities mentionedAll →
- CVE-2026-1069318.51%OS command injection in SiteGuard Server Editionpublished · EG Secure Solutions SiteGuard Server Edition KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-106931 | OS command injection in SiteGuard Server Edition SiteGuard Server Edition has an OS command injection flaw (CWE-78) that lets an attacker run arbitrary operating-system commands. The published CVSS 4.0 vector rates the attack as local, low complexity, and requiring only low privileges, with no user interaction, and with high impact to confidentiality, integrity, and availability on the host. Successful exploitation can yield command execution as root on Unix-like systems or as SYSTEM on Windows. The product is a host-based web application firewall, so affected systems are servers where SiteGuard Server Edition is installed; specific version ranges are not given in the advisory data. It is not listed in CISA KEV, and no public proof-of-concept is known. |
Full article365 words · extracted from bleepingcomputer.com · click to collapse
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines.
The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default.
SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites. Based on WordPress.org statistics, the product is active on 500,000 sites.
According to the vendor’s bulletin and a warning from Japan's CERT agency, CVE-2026-106931 has critical severity and is currently being exploited in the wild.
“An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed,” reads SiteGuard’s alert.
The attacker’s identity, the victims, the scale of the attacks, and the methods used remain unclear, as neither security advisory provides these details.
According to the vendor, the following versions of the product are vulnerable to CVE-2026-106931:
- SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 and later, before 8.00 Update 5.
- SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD versions 2.20 and later, before 7.00 Update 6.
Successful exploitation is possible in the above versions if the statistics function is active. IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected, JPCERT/CC notes.
For installations that cannot be upgraded, the vendor offers a patch that replaces files used in statistics processing, including for end-of-life versions.
The vendor warns that remediation may erase attack traces, and recommends that administrators preserve evidence before updating or patching.
To do this, administrators are instructed to download and retain “Diagnostic information” from the web management interface (Web management screen ‐>Diagnostic information‐> Download diagnostic information)
The vendor said customers with direct support contacts were notified of the flaw earlier, on September 29.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.