Hackers exploit critical SiteGuard WAF flaw to gain root, SYSTEM access

Vulnerability in statistics feature actively exploited, vendor warns

By LineZotpaper

Published19 October 2026

Read Time2 min

Hackers are exploiting an OS command-injection vulnerability in SiteGuard Server Edition, a web application firewall widely used in Japan, to execute commands with root or SYSTEM privileges on affected systems. The flaw, tracked as CVE-2026-106931, affects the product's statistics function, which is enabled by default, and is rated critical severity by Japan's CERT agency.

According to the vendor and JPCERT/CC, the vulnerability is currently being exploited in the wild. Attackers can inject operating system commands through the statistics function of host-based instances of SiteGuard Server Edition.

SiteGuard claims to protect more than 1.5 million websites, with WordPress.org statistics showing the product active on 500,000 sites. The following versions are vulnerable:

SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 and later, before 8.00 Update 5.
SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD versions 2.20 and later, before 7.00 Update 6.

IIS editions 3.10 through 4.00 Update 4 are not affected. Successful exploitation is possible only if the statistics function is active.

For installations that cannot be upgraded, the vendor offers a patch that replaces files used in statistics processing, including for end-of-life versions. The vendor warns that remediation may erase attack traces and recommends that administrators preserve evidence before updating. Evidence can be saved by downloading diagnostic information from the web management interface.

Customers with direct support contacts were notified of the flaw on September 29, according to SiteGuard. The attacker's identity, the scale of attacks, and the methods used remain unclear, as the security advisories do not provide these details.

Analysis

Why This Matters

Any of the 500,000 active SiteGuard installations with the statistics feature enabled are potentially exposed to remote code execution with full system privileges.
The vulnerability is already being actively exploited, meaning administrators face an urgent timeline to patch or apply mitigations.
Because remediation can destroy forensic evidence, organisations must take steps to preserve logs and diagnostic data before applying updates.

Background

SiteGuard is a major Japanese web application firewall vendor. Its Server Edition runs on Apache httpd, Nginx and IIS, protecting websites from common attacks such as SQL injection and cross-site scripting. The vulnerability lies in the statistics function, a feature that is switched on by default in host-based instances. JPCERT/CC assigned the flaw a critical severity rating after confirming active exploitation.

Key Perspectives

The vendor (SiteGuard): The company issued a security bulletin and provided patches for both current and end-of-life versions. It recommends that customers preserve diagnostic information before updating to avoid losing evidence of intrusion. JPCERT/CC: Japan's computer emergency response team confirmed the vulnerability's critical severity and that it is being exploited in the wild, amplifying pressure on administrators to act. Administrators and system owners: They must balance the need for immediate patching with the risk of destroying forensic data. Those without direct support contracts may be unaware of the September 29 notification.

What to Watch

Whether reports of specific attacker groups or large-scale compromises emerge in the coming days.
How quickly administrators patch vulnerable systems, and whether unpatched installations remain exposed.
If the vulnerability is used as a vector for further attacks such as ransomware deployment or data exfiltration.

Sources

Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root · BleepingComputer

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedHackers are exploiting the flaw to execute commands with root or SYSTEM privileges.BleepingComputer: “Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall (WAF), allowing them to execute commands with root or SYSTEM privileges on affected machines.”
SupportedThe vendor warns that the statistics-feature vulnerability is actively exploited.BleepingComputer: ““An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed,” reads SiteGuard’s alert .”
Not in the sourcesSiteGuard Server Edition is widely used in Japan.
SupportedThe affected statistics feature is enabled by default.BleepingComputer: “The security issue is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default.”
SupportedJapan's CERT agency rates CVE-2026-106931 as critical.BleepingComputer: “According to the vendor’s bulletin and a warning from Japan's CERT agency, CVE-2026-106931 has critical severity and is currently being exploited in the wild.”
SupportedSiteGuard claims to protect more than 1.5 million websites.BleepingComputer: “SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites .”
SupportedWordPress.org statistics show the product active on 500,000 sites.BleepingComputer: “Based on WordPress.org statistics, the product is active on 500,000 sites.”
SupportedThe listed non-FreeBSD versions before 8.00 Update 5 and FreeBSD versions before 7.00 Update 6 are vulnerable.BleepingComputer: “SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 and later, before 8.00 Update 5. SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD versions 2.20 and later, before 7.00 Update 6.”
SupportedIIS editions 3.10 through 4.00 Update 4 are not affected.BleepingComputer: “IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected, JPCERT/CC notes .”
SupportedSuccessful exploitation is possible only when the statistics function is active.BleepingComputer: “Successful exploitation is possible in the above versions if the statistics function is active.”
SupportedThe vendor offers a statistics-processing patch, including for end-of-life versions, when upgrading is impossible.BleepingComputer: “For installations that cannot be upgraded, the vendor offers a patch that replaces files used in statistics processing, including for end-of-life versions.”
SupportedThe vendor warns remediation may erase attack traces and recommends preserving evidence first.BleepingComputer: “The vendor warns that remediation may erase attack traces, and recommends that administrators preserve evidence before updating or patching.”