Science & Tech · Cybersecurity · 12 hrs ago
Hackers exploit SiteGuard flaw to run commands with root or SYSTEM access
Attackers are exploiting a command-injection flaw in SiteGuard Server Edition, a web application firewall made in Japan.
The flaw, tracked as CVE-2026-106931, affects the product’s statistics feature, which is enabled by default.
Successful attacks can give hackers root or SYSTEM access to the server running the firewall.
The vulnerable versions include releases before 8.00 Update 5 on most systems and before 7.00 Update 6 on some FreeBSD systems; certain IIS versions are not affected.
The attacker’s identity, the victims and the number of affected systems are not known, and the vendor says local access with low-level privileges is needed to exploit the flaw.
Administrators should check for signs of compromise and preserve diagnostic information before updating, because patching can erase traces of an attack.
The vendor offers updates and a patch for installations that cannot be upgraded.
Attackers are exploiting CVE-2026-106931, an OS command-injection flaw in SiteGuard Server Edition, to run commands with root or SYSTEM privileges.
The flaw affects the product’s statistics feature, which is enabled by default.
The affected versions vary by platform, and exploitation requires the statistics function to be active.
The attackers, victims, attack methods and number of affected systems have not been identified.
The vendor offers a patch for installations that cannot be upgraded and advises administrators to save diagnostic information before remediation.
- Who
- Threat actors are exploiting the flaw. Their identities are unknown.
- What
- They can use an OS command-injection flaw to run commands with root or SYSTEM privileges.
- When
- Exploitation has been confirmed; the vendor notified direct-support customers on September 29, 2026, and public alerts appeared on October 14.
- Where
- Affected SiteGuard Server Edition installations on web servers.
- Why
- The flaw allows elevated command execution. The attackers’ motives are not stated.
This story does not have two clearly opposing sides.
The vendor notified customers with direct support contracts about the vulnerability.
The public alert and JVN advisory were published.
BleepingComputer published its report on the exploitation.
Security Affairs published its report on the exploitation.
- Vulnerability
- CVE-2026-106931
- Product
- SiteGuard Server Edition
- Privilege level
- Root or SYSTEM
- CVSS 4.0 score
- 8.5
- Apache, Nginx and IIS versions
- Before 8.00 Update 5, excluding FreeBSD
- FreeBSD Apache and Nginx versions
- Before 7.00 Update 6
3 sources
What people are saying
An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed.
Before updating, please be sure to download and save your “Diagnostic Information” (as this may erase traces of the attack).