Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Attackers are exploiting SiteGuard WAF flaw CVE-2026-106931 to run commands as root or SYSTEM.
Attackers are exploiting CVE-2026-106931, a critical OS command-injection flaw in SiteGuard Server Edition's statistics function, which is enabled by default. Successful attacks can run commands as root or SYSTEM on vulnerable Apache, Nginx, and IIS installations. SiteGuard, which says it protects more than 1.5 million websites, and JPCERT/CC confirm abuse, though attacker identity, victims, and scale are unknown. Fixed releases and a file-replacement patch are available, and administrators are told to save diagnostic information before remediation.
- CVE-2026-106931 is OS command injection in the default statistics feature.
- Vulnerable builds include Apache, Nginx, and IIS editions before the listed updates.
- SiteGuard and JPCERT/CC confirm exploitation, but victims and scale are unknown.
- A patch or file replacement is available; preserve diagnostics before updating.
Coverage timelineoldest first · each row is one article
- · 4d agoHackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
BleepingComputer· 78
Attackers are exploiting SiteGuard WAF flaw CVE-2026-106931 to run commands as root or SYSTEM.
- · 3d agoJapan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited
Security Affairs· 35
- · 3d agoHackers Exploit SiteGuard WAF Vulnerability That Could Give Them Full Control of Servers
Cyber Security News· 25
Vulnerabilities in this storyAll →
- CVE-2026-1069318.51%OS command injection in SiteGuard Server Editionpublished · EG Secure Solutions SiteGuard Server Edition KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-106931 | OS command injection in SiteGuard Server Edition SiteGuard Server Edition has an OS command injection flaw (CWE-78) that lets an attacker run arbitrary operating-system commands. The published CVSS 4.0 vector rates the attack as local, low complexity, and requiring only low privileges, with no user interaction, and with high impact to confidentiality, integrity, and availability on the host. Successful exploitation can yield command execution as root on Unix-like systems or as SYSTEM on Windows. The product is a host-based web application firewall, so affected systems are servers where SiteGuard Server Edition is installed; specific version ranges are not given in the advisory data. It is not listed in CISA KEV, and no public proof-of-concept is known. |