Hackers Exploit Critical SiteGuard WAF Flaw to Execute Commands as SYSTEM or Root

Hackers are actively exploiting a critical OS command injection vulnerability in SiteGuard Server Edition Web Application Firewall (WAF), allowing attackers to execute commands with root or SYSTEM privileges on affected machines.

Tracked as CVE-2026-106931, the vulnerability affects the statistics feature in host-based SiteGuard WAF installations. The feature is enabled by default.

SiteGuard WAF vulnerability exploited in the wild

SiteGuard is a leading Japanese WAF vendor that claims to protect 1.5 million websites. Based on WordPress.org statistics, the SiteGuard plugin is active on 500,000 sites.

According to vendor bulletins and alerts from Japan’s CERT agency, CVE-2026-106931 is critical and is currently being exploited in the wild.

“An OS command injection vulnerability (CVE-2026-106931) has been discovered in the statistics functionality of SiteGuard Server Edition. Exploitation has already been confirmed.” Read the SiteGuard alert.

Neither security advisory provides technical details about the attacks. The identity of the attacker, the victims, the scale of the exploitation, and the techniques used remain unknown.

Affected SiteGuard Server Edition versions

According to the vendor, the following SiteGuard Server Edition versions are vulnerable to CVE-2026-106931:

• SiteGuard Server Edition for Apache httpd, Nginx, and IIS, excluding FreeBSD: versions 2.20 and later, before 8.00 Update 5.
• SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD: versions 2.20 and later, before 7.00 Update 6.

The affected versions may be successfully exploited when the statistics feature is enabled. IIS editions 3.10 through 4.00 Update 4 are not affected, according to JPCERT/CC.

SiteGuard urges customers to preserve evidence before patching

Administrators should upgrade affected installations or apply the vendor-provided patches. For installations that cannot be upgraded, the patches replace files used for statistical processing that contain end-of-support versions.

The vendor warns that remediation can erase evidence of an attack. Administrators are therefore encouraged to preserve forensic information before applying updates or patches.

To preserve this information, administrators should download and retain the Diagnostic Information file from the web administration interface:

Web Admin → Diagnostic Information → Download Diagnostic Information

The vendor said customers with direct support contacts were notified of the vulnerability on September 29.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report