Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM or root

Attackers are exploiting an operating system command-injection flaw in SiteGuard Server Edition, a web application firewall (WAF), to run commands with root or SYSTEM privileges on affected servers, according to BleepingComputer.

The vulnerability, tracked as CVE-2026-106931, affects the statistics feature in host-based WAF installations. That feature is enabled by default. SiteGuard and Japan's CERT agency say exploitation has been confirmed and rate the flaw as critical.

The attacker’s identity, affected organizations, attack scale and methods remain unclear, as neither advisory provides those details. Successful exploitation is possible in affected versions when the statistics function is active. JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected.

For installations that cannot be upgraded, SiteGuard offers a patch that replaces files used for statistics processing, including for end-of-life versions. The vendor warns that remediation may erase traces of an attack and recommends preserving evidence first. It instructs administrators to download and retain “Diagnostic information” through the web management interface.

SiteGuard says it notified customers with direct support contacts about the flaw on September 29. The supplied report does not identify a year for that date.