Attackers exploit a critical SiteGuard WAF flaw to run commands with root or SYSTEM privileges

Attackers are exploiting CVE-2026-106931, a critical OS command-injection vulnerability in SiteGuard Server Edition, a host-based web application firewall from a major Japanese vendor. The flaw is in the product's statistics feature, which is enabled by default. Successful exploitation lets an attacker run commands with root or SYSTEM privileges on the affected machine. SiteGuard's own bulletin and a warning from Japan's CERT agency both say the flaw is being abused. The vendor's alert reads: "Abuse has already been confirmed." Neither advisory says who the attackers are, who has been hit, how large the attacks are or how they work. Affected versions are SiteGuard Server Edition for Apache httpd, Nginx and IIS from 2.20 up to but not including 8.00 Update 5. On FreeBSD, versions for Apache httpd and Nginx from 2.20 up to but not including 7.00 Update 6 are affected. SiteGuard says its products protect more than 1.5 million websites, and BleepingComputer cites WordPress.org statistics showing the product active on 500,000 sites. Because the flaw sits in a security product that runs on the web server itself, administrators running the Server Edition should move to the fixed releases and check their hosts for signs of compromise.