SiteGuard WAF Flaw Exploited to Execute Commands With Full Privileges

Attackers are exploiting a critical SiteGuard WAF flaw that lets them execute operating system commands with root or SYSTEM privileges. The vulnerability affects SiteGuard Server Edition, a host-based web application firewall.

Tracked as CVE-2026-106931, the command-injection bug sits in the product’s statistics feature. This feature runs by default, leaving vulnerable installations exposed unless administrators disable it or apply a fix.

Both the vendor and Japan’s computer emergency response authorities have confirmed active exploitation. However, they have not disclosed who is responsible or how many systems attackers have compromised.

Statistics Feature Creates an Entry Point

The vulnerability affects installations that run a vulnerable software version with the statistics function active. Successful exploitation allows attackers to execute commands with the operating system’s highest privileges.

As a result, the flaw creates a serious risk for affected servers. Nevertheless, the public advisories provide no details about the attack methods, targets or activities following exploitation.

Although SiteGuard products serve a large website base, those broader adoption figures do not establish how many Server Edition installations face exposure.

Which SiteGuard Versions Are Vulnerable?

The SiteGuard WAF flaw affects different release ranges depending on the operating system and web server:

• Apache httpd, Nginx and IIS, excluding FreeBSD: Versions 2.20 and later, before 8.00 Update 5.
• Apache httpd and Nginx on FreeBSD: Versions 2.20 and later, before 7.00 Update 6.

However, IIS editions from 3.10 through 4.00 Update 4, inclusive, are exempt from the affected versions.

Administrators should therefore check their platform, release number and statistics settings when assessing exposure.

Updates and Replacement Patches Address the Flaw

The corrected releases are 8.00 Update 5 for affected platforms outside FreeBSD and 7.00 Update 6 for FreeBSD installations.

For customers who cannot upgrade, the vendor also provides a separate patch. It replaces files involved in statistics processing and covers end-of-life versions as well.

Consequently, administrators running older deployments have a remediation option even when a full version upgrade is not immediately possible.

Preserve Diagnostic Information Before Applying Fixes

Before updating or patching, administrators should retain diagnostic information from the affected installation. The vendor warns that remediation may erase traces of an attack.

To preserve that evidence, open the web management interface, select Diagnostic information, and choose Download diagnostic information. Keep the downloaded information available for any subsequent investigation.

The vendor says it notified customers with direct support contacts on September 29. Meanwhile, the confirmed exploitation makes prompt remediation a priority once administrators have preserved the available evidence.