Cybersecurity
Hackers exploit SiteGuard WAF flaw for root access
SiteGuard said an OS command-injection flaw in its Server Edition WAF was being used against affected systems, while JPCERT/CC warned that it could grant attackers root or SYSTEM privileges.
- SiteGuard said attackers had been exploiting CVE-2026-106931 in SiteGuard Server Edition.
- The flaw was an OS command-injection issue in the statistics function and could let an attacker run commands with root or SYSTEM privileges.
- SiteGuard and JPCERT/CC described the issue as critical and said abuse had already been confirmed.
- The vendor listed affected editions for Apache httpd, Nginx and IIS, plus a FreeBSD variant, and said successful exploitation required the statistics function to be enabled.
- For systems that could not be upgraded, SiteGuard offered a patch and advised administrators to save diagnostic information first because remediation could remove traces.
Attackers were exploiting an OS command-injection flaw in SiteGuard Server Edition. The issue was tracked as CVE-2026-106931 and affected the statistics feature in host-based WAF instances, which was enabled by default.
SiteGuard said abuse had already been confirmed, and JPCERT/CC said the issue was being exploited in the wild. Neither notice identified the attackers, the victims, the scale of the activity, or the method used.
The vendor said the vulnerable releases were SiteGuard Server Edition for Apache httpd, Nginx and IIS, excluding FreeBSD, from 2.20 and later before 8.00 Update 5. It also listed the FreeBSD versions as 2.20 and later before 7.00 Update 6, and said IIS editions 3.10 through 4.00 Update 4 were not affected.
SiteGuard said customers who could not upgrade could use a patch that replaced files used in statistics processing, including on end-of-life versions. It also warned that remediation might erase evidence and told administrators to download diagnostic information before updating; customers with direct support contacts had been notified on 29 September.
Named in this story
Companies
- SiteGuard
- issued the bulletin and offered a patch
Organisations
- JPCERT/CC
- warned that the issue was being exploited in the wild
Products and systems
- SiteGuard Server Edition
- the WAF product affected by the flaw
- Apache httpd
- one of the supported platforms named in the affected editions
- Nginx
- one of the supported platforms named in the affected editions
- IIS
- one of the supported platforms named in the affected editions
- FreeBSD
- the operating system used by one affected variant
How the source tells it
The piece was mostly neutral, with a brief urgent register around the confirmed exploitation warning.
- urgency critical-severity labelling and confirmation that abuse had already been seen