Attackers are actively exploiting a critical OS command-injection vulnerability, tracked as CVE-2026-106931, in the SiteGuard Server Edition web application firewall, executing arbitrary commands with root or SYSTEM privileges on compromised machines. BleepingComputer reports that the vulnerability is located in the product’s statistics feature, which is active by default on affected installations.
The vendor, which claims to protect more than 1.5 million websites, confirmed exploitation in its own security alert: ‘An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed.’ WordPress.org statistics put the product’s active install count at 500,000 sites. Japan’s CERT agency, JPCERT/CC, issued a concurrent warning, and both advisories rate the issue as critical severity.
Which versions are affected
According to the vendor’s bulletin and JPCERT/CC, the following product variants are vulnerable if the statistics function is active:
SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD), versions 2.20 and later, before 8.00 Update 5. SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD, versions 2.20 and later, before 7.00 Update 6. JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected.
Cyber Kendra reports that the vulnerability scores 8.5 under CVSS version 4.0 and 7.8 under CVSS version 3. The Tokyo-based developer, EG Secure Solutions, reported the vulnerability to Japan’s Information-technology Promotion Agency itself, with JPCERT/CC coordinating the public disclosure. Customers with direct support contracts were privately notified on 29 September, two weeks before the public advisory, and received the upgrade and an individual patch at that point, according to Cyber Kendra.
Remediation and evidence preservation
For installations that cannot be upgraded immediately, the vendor offers a file-replacement patch covering the statistics-processing components, including for end-of-life versions. There is a catch, though: the vendor warns that applying remediation may erase traces of any attack that has already occurred.
Administrators are therefore instructed to first download and retain ‘Diagnostic information’ from the web management interface before patching or upgrading. The vendor’s alert describes the path as: Web management screen, then Diagnostic information, then Download diagnostic information.
The identities of the attackers, the number of victims, the scale of the attacks, and the methods used to gain initial access remain unknown. Neither the vendor’s advisory nor JPCERT/CC has provided those details.
