Hackers Exploit Critical SiteGuard WAF Command-Injection Flaw
Summary
CVE-2026-106931, a critical command-injection flaw in SiteGuard Server Edition’s statistics feature, is being exploited. Affected versions can allow root or SYSTEM command execution; administrators should preserve diagnostic evidence before applying fixes.
Key points
- The vendor and JPCERT/CC report active exploitation of CVE-2026-106931, a critical OS command-injection flaw.
- The flaw affects the statistics feature in SiteGuard Server Edition host-based WAF installations; the feature is enabled by default.
- Vulnerable releases include versions 2.20 and later before 8.00 Update 5, with separate FreeBSD Apache httpd/Nginx versions affected before 7.00 Update 6.
- Successful exploitation can enable commands with root or SYSTEM privileges. IIS versions 3.10 through 4.00 Update 4 are noted as unaffected.
- The vendor provides upgrades and a patch for installations that cannot be upgraded, including end-of-life versions.
- Administrators are advised to save diagnostic information before remediation because updating or patching may erase attack traces.
- The attackers, affected organizations, attack scale, and exploitation methods have not been disclosed.
Article Details
- Vulnerability Types
- OS command injection
- Severity
- Critical
- Affected Versions
- SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD): versions 2.20 and later, before 8.00 Update 5
- SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD: versions 2.20 and later, before 7.00 Update 6
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available