SiteGuard WAF vulnerability lets attackers run commands as root

Hackers are actively abusing a dangerous OS command-injection flaw in SiteGuard Server Edition, a widely used web application firewall. The flaw, labeled CVE-2026-106931, targets the product’s statistics module, which is enabled by default on many installations. When exploited, attackers can execute commands with root or SYSTEM privileges on the compromised machine.

The issue was disclosed by SiteGuard and is also highlighted by Japan’s CERT. The company lists affected versions of SiteGuard Server Edition for Apache httpd, Nginx, and IIS as versions 2.20 and later, up to 8.00 Update 5, with separate notes for FreeBSD deployments (2.20 and later up to 7.00 Update 6). IIS 3.10 through 4.00 Update 4 are not affected. If your firewall is running a vulnerable build and the statistics feature is enabled, you could be at risk.

Details about who exactly is being targeted and how the attacks unfold aren’t fully disclosed. SiteGuard notes that attackers who obtain valid credentials can bypass some protections, making it easier to move from initial access to full control.

For admins who need to act quickly, SiteGuard has a patch that replaces the files involved in statistics processing. If upgrading can’t happen right away, this fix is the recommended path. The vendor warns that remediation could erase attack traces, so administrators should prepare to collect evidence before applying the fix. One practical step is to export diagnostic data from the web management area before patching, so you have a record of what happened.

Beyond patching, consider whether the statistics function is necessary for your setup. If you can’t patch immediately, temporarily disable statistics processing to reduce exposure while you work on updates. Also double-check account access controls, since attackers with valid credentials pose a higher risk even on strong defenses.

This serves as a reminder that a routinely enabled feature can become an entry point if a vulnerability exists in the surrounding code. Regular patch cycles, quick testing of updates, and monitoring firewall logs remain essential to staying safe.