Attackers exploit SiteGuard WAF flaw to run commands as root or SYSTEM

BleepingComputer reported on October 18, 2026 that hackers are actively exploiting a critical command injection bug in SiteGuard Server Edition, a host-based web application firewall from a leading Japanese vendor. The flaw, CVE-2026-106931, sits in the product's statistics feature, which is switched on by default, and lets attackers run operating system commands with root or SYSTEM rights. Both the vendor and Japan's CERT agency say abuse has been confirmed, though neither has said who is behind it or how many sites were hit.

SiteGuard says it protects more than 1.5 million websites, and WordPress.org figures show the product active on 500,000 sites. Vulnerable releases include the Apache httpd, Nginx and IIS editions (excluding FreeBSD) from version 2.20 up to before 8.00 Update 5, and the FreeBSD builds for Apache and Nginx from 2.20 up to before 7.00 Update 6. IIS editions 3.10 through 4.00 Update 4 are not affected, according to JPCERT/CC.

Admins who cannot upgrade can apply a vendor patch that swaps out the statistics files, and it covers end-of-life versions too. Because fixing the issue can wipe traces of an attack, the vendor advises saving the diagnostic information from the web management screen before patching. Customers with direct support contacts were warned on September 29.

Why it matters

A tool meant to protect web servers is being used as a way in with full admin rights, so affected sites should save evidence and patch now.

Source: BleepingComputer