Hackers Exploit SiteGuard WAF Flaw for Root Access
Attackers are actively targeting a critical OS command-injection vulnerability in SiteGuard Server Edition, allowing them to execute arbitrary commands with root or SYSTEM privileges on affected machines.
Radwan AbdulhadiEditor and technology writer
Critical Vulnerability in SiteGuard Server Edition
According to reporting by [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/), hackers are actively exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall. This security flaw grants unauthorized actors the ability to execute commands with root or SYSTEM privileges on vulnerable machines.
The vulnerability is tracked under the identifier CVE-2026-106931 and specifically impacts the statistics feature within host-based WAF instances, where the function is enabled by default. SiteGuard is a leading Japanese security vendor that protects [1.5 million websites](https://www.e-guardian.co.jp/info/2024/20240122.html) worldwide. Furthermore, platform metrics from [500,000 sites.](https://wordpress.org/plugins/siteguard/) show the widespread integration of the product across various hosting environments.
Active Exploitation and Advisory Details
Both the product vendor and national security authorities have issued urgent warnings regarding the issue. [reads SiteGuard’s alert](https://www.eg-secure.co.jp/siteguard/news/alert-202610-1) to confirm that abuse of the flaw has already been confirmed in real-world environments. The severity of CVE-2026-106931 is rated as critical, prompting [JPCERT/CC notes](https://jvn.jp/en/jp/JVN88474777/index.html) to provide detailed guidance to system administrators.
Despite confirmation that attacks are underway, precise information concerning the identity of the attackers, targeted victims, overall campaign scale, and exact methodologies remains undisclosed. Neither security advisory has published specific forensic indicators outlining who is behind the exploitation wave.
Affected Software Versions
The [vendor warns](https://www.eg-secure.co.jp/siteguard/news/alert-202610-1) that multiple software iterations are susceptible to CVE-2026-106931 if their built-in statistics function remains active. Specifically, SiteGuard Server Edition for Apache httpd, Nginx, and IIS versions 2.20 and later—excluding FreeBSD—up to versions before 8.00 Update 5 are affected. For FreeBSD deployments running Apache httpd and Nginx, versions 2.20 and later prior to 7.00 Update 6 are vulnerable.
In contrast, IIS editions ranging from version 3.10 through 4.00 Update 4 inclusive are not impacted by the vulnerability, according to documentation provided by JPCERT/CC and the vendor.
Remediation and Forensic Preservation
For server deployments that cannot undergo a full upgrade immediately, the vendor has made a specialized patch available. This remediation package replaces the specific files responsible for statistics processing, and support is extended even to end-of-life product versions.
However, the vendor emphasizes that applying the remediation patch may unintentionally erase existing attack traces from the system. Administrators are strongly advised to preserve evidentiary logs before executing any updates. To retain necessary data, operators must navigate the web management interface to download diagnostic information via the dedicated diagnostic screen.
Customers maintaining direct support relationships with the vendor received advance notifications regarding the security flaw earlier on September 29, allowing some organizations additional time to prepare mitigation strategies ahead of public disclosure.
Sources
- BleepingComputerHackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
Continue chronologically
Related stories
Collabora RCE Flaw Exploited to Backdoor Nextcloud Servers
Threat actors are actively exploiting a critical command execution flaw tracked as CVE-2026-110447 in the Collabora Online built-in CODE server app for Nextcloud.
Germany Arrests Alleged Core Qilin Ransomware Member
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following an extradition from Japan.
ASOS Confirms Cyberattack After Rogue In-App Notifications
British online retailer ASOS confirms a data breach following unauthorized push notifications sent to users via a compromised third-party platform.
CISA Confirms Active Exploitation of Maximum-Severity GitLab Flaw
CISA confirms active exploitation of a maximum-severity GitLab vulnerability tracked as CVE-2026-97229 and urges administrators to apply patches immediately.
