Hackers exploit SiteGuard WAF flaw to run commands as admins
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines.
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines.
The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default.
SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites .
Based on WordPress.org statistics, the product is active on 500,000 sites.
According to the vendor’s bulletin and a warning from Japan's CERT agency, CVE-2026-106931 has critical severity and is currently being exploited in the wild.
“An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition.
Abuse has already been confirmed,” reads SiteGuard’s alert .
The attacker’s identity, the victims, the scale of the attacks, and the methods used remain unclear, as neither security advisory provides these details.
IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected, JPCERT/CC notes .
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
According to the vendor, the following versions of the product are vulnerable to CVE-2026-106931: Successful exploitation is possible in the above versions if the statistics function is active.
For installations that cannot be upgraded, the vendor offers a patch that replaces files used in statistics processing, including for end-of-life versions.
The vendor warns that remediation may erase attack traces, and recommends that administrators preserve evidence before updating or patching.
To do this, administrators are instructed to download and retain from the web management interface (Web management screen ‐>Diagnostic information‐> Download diagnostic information) The vendor said customers with direct support contacts were notified of the flaw earlier, on September 29.
What happened
Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines.
The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default.
SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites .
What changed
Based on WordPress.org statistics, the product is active on 500,000 sites.
According to the vendor’s bulletin and a warning from Japan's CERT agency, CVE-2026-106931 has critical severity and is currently being exploited in the wild.
“An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition.
Who is affected
Abuse has already been confirmed,” reads SiteGuard’s alert .
The attacker’s identity, the victims, the scale of the attacks, and the methods used remain unclear, as neither security advisory provides these details.
Why it matters
IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected, JPCERT/CC notes .
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Technical details
According to the vendor, the following versions of the product are vulnerable to CVE-2026-106931: Successful exploitation is possible in the above versions if the statistics function is active.
For installations that cannot be upgraded, the vendor offers a patch that replaces files used in statistics processing, including for end-of-life versions.
Response
The vendor warns that remediation may erase attack traces, and recommends that administrators preserve evidence before updating or patching.
To do this, administrators are instructed to download and retain from the web management interface (Web management screen ‐>Diagnostic information‐> Download diagnostic information) The vendor said customers with direct support contacts were notified of the flaw earlier, on September 29.
What remains unknown
The attacker’s identity, the victims, the scale of the attacks, and the methods used remain unclear, as neither security advisory provides these details.
Attribution
BleepingComputer: Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.