Hackers are exploiting an operating system command entry vulnerability in SiteGuard Server Edition’s web application firewall (WAF), which allows them to execute commands with ROOT or SYSTEM privileges on affected computers.
The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default.
SiteGuard is a leading Japanese WAF provider that claims to do more than protect 1.5 million websites. Based on WordPress.org statistics, the product is active on 500,000 websites.
According to the vendor’s bulletin and an alert from the Japanese CERT agency, CVE-2026-106931 is of critical severity and is currently being exploited in the wild.
“An operating system command injection vulnerability (CVE-2026-106931) was found in the statistics function of SiteGuard Server Edition. Misuse has already been confirmed.” reads SiteGuard’s warning.
The identity of the attacker, the victims, the scale of the attacks and the methods used remain unclear as none of the security advisories provide these details.
According to the vendor, the following versions of the product are vulnerable to CVE-2026-106931:
- SiteGuard Server Edition for Apache httpd, Nginx and IIS (except FreeBSD) versions 2.20 and later, before 8.00 Update 5.
- SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD versions 2.20 and later, before 7.00 Update 6.
Successful exploitation is possible in the above versions if the statistics function is active. IIS editions 3.10 up to and including 4.00 Update 4 are not affected. JPCERT/CC notes.
For installations that cannot be updated, the vendor offers a patch that replaces files used in statistics processing, including for end-of-life versions.
The Provider warns that the fix can remove traces of attack and recommends that administrators preserve evidence before applying updates or patches.
For this purpose, administrators are instructed to download and retain “Diagnostic Information” from the web management interface (Web Management Screen -> Diagnostic Information -> Download Diagnostic Information).
The provider said customers with direct support contacts were informed of the error on September 29th.
