Attackers are exploiting a command injection vulnerability in SiteGuard Server Edition, a web application firewall that runs directly on the servers it protects.
Recorded as CVE-2026-106931, the flaw can allow execution of operating-system commands with elevated privileges (root on Unix or SYSTEM on Windows), potentially giving an attacker complete control of an affected host.
The vulnerability affects SiteGuard’s statistics feature, which is enabled by default. Vendor EG Secure Solutions confirmed active exploitation and notified customers with direct support contracts on September 29, 2026. Japan’s vulnerability coordination service posted a JVN advisory on October 14, and JPCERT/CC also issued an alert.
Classified under CWE-78 (OS command injection), the issue lets an attacker inject and run OS commands via the statistics-processing function. Although those commands may run with root or SYSTEM privileges, the advisories describe the issue as a local attack that requires low privileges and no user interaction.
Hackers exploit SiteGuard WAF vulnerability
Administrators should treat this as a method to escalate from limited local access to higher privileges, rather than as proof of a remote, login-free compromise. The vulnerability scores 8.5 under CVSS 4.0 and 7.8 under CVSS 3.0.
Neither advisory names the attackers or affected organizations, quantifies attack volume, nor details the exact exploitation technique. Similar appliance risks have been reported previously—such as a command injection issue in a Hillstone WAF—but that incident is distinct from the SiteGuard flaw.
Affected releases begin with SiteGuard Server Edition 2.20 when the statistics function is enabled. Administrators running Apache, Nginx, or IIS editions (not on FreeBSD) should upgrade to version 8.00 Update 5. FreeBSD deployments using Apache or Nginx should move to version 7.00 Update 6.
There is an important exception for Windows: IIS editions from 3.10 through 4.00 Update 4 are not vulnerable. Because exposure depends on both the installed version and whether statistics are enabled, confirm both when assessing risk.
Organizations that cannot immediately upgrade can request a vendor-supplied patch that replaces the files used for statistics processing; EG Secure Solutions has made this option available even for releases that are no longer supported.
Before applying an update or patch, administrators should download and save diagnostic data, since remediation may remove attack traces. In the product’s web management interface, open “Diagnostic Information,” select “Download Diagnostic Information,” and retain the downloaded file before making changes.
Collecting this evidence first supports later investigation, as recommended in digital-forensics and incident-response guidance. With exploitation confirmed, affected organizations should preserve diagnostics and apply the appropriate fixes without delay.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
