"An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed," SiteGuard warned in its alert.
CVE-2026-106931: OS command injection in the statistics feature
Security researchers and the vendor agree that CVE-2026-106931 is an OS command-injection vulnerability in the statistics function of SiteGuard Server Edition, a host-based web application firewall (WAF). When successfully exploited, the flaw allows attackers to execute operating-system commands with root or SYSTEM privileges on affected machines. SiteGuard and Japan's CERT agency (JPCERT/CC) have both said the vulnerability is being exploited in the wild and have classified it as critical.
Scope: how many installations could be at risk
SiteGuard positions itself as a major WAF vendor, saying it protects more than 1.5 million websites; WordPress.org statistics list the product as active on 500,000 sites. The vulnerability is triggered by the statistics function, which is enabled by default in host-based deployments — meaning administrators who have not disabled that feature and who run vulnerable versions may be exposed.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleVersions affected, and exceptions noted by JPCERT/CC
According to the vendor’s bulletin, the following versions are vulnerable when the statistics feature is active:
- SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD): versions 2.20 and later, before 8.00 Update 5.
- SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD: versions 2.20 and later, before 7.00 Update 6.
JPCERT/CC added that IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected. The vendor emphasizes that successful exploitation requires the statistics function to be active.
Vendor response, evidence preservation, and notification timeline
SiteGuard has published an alert and provided remediation files. For installations that cannot be upgraded to a fixed release, the vendor offers a patch that replaces the files used in statistics processing — the vendor said this replacement is available even for end-of-life versions. The company warns administrators that remediation may erase attack traces and therefore recommends preserving evidence before updating or patching. Specifically, administrators are instructed to download and retain "Diagnostic information" from the web management interface (Web management screen ‐> Diagnostic information ‐> Download diagnostic information).
SiteGuard reported that customers with direct support contacts were notified of the flaw earlier, on September 29. Beyond that, the attacker’s identity, the victims, the scale of the attacks, and the methods used remain unclear, as neither the vendor bulletin nor JPCERT/CC's warning provides those details.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Check whether SiteGuard Server Edition is installed and whether the statistics function remains enabled; if it is, apply the vendor’s upgrade or the replacement-files patch and preserve diagnostic information before remediation as instructed.
- Procurement and operations leaders: Factor the vendor's scale claims — SiteGuard says it protects more than 1.5 million websites and is active on 500,000 WordPress sites — into risk assessments and supply-chain discussions, and confirm support channels and update paths for affected editions, including end-of-life releases.
- End users and site owners: If your hosting stack includes SiteGuard Server Edition, treat this as a high-priority security event: determine whether your instance uses the statistics feature and coordinate with administrators to obtain diagnostic data and apply vendor-supplied fixes.
Broader defensive signal: prevention can collapse after initial access
The incident also underscores a point raised by Blue Report 2026: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments — a reminder that even widely deployed protective products, if misconfigured or vulnerable, can be bypassed and used to gain privileged control.
SiteGuard's bulletin and JPCERT/CC's warning together establish a clear and immediate technical remediation path: identify affected versions where the statistics feature is active, preserve diagnostic evidence via the web management interface before updating, and apply the vendor-provided fixes — including replacement files where upgrades are not possible. Beyond that, the unanswered facts — who is exploiting the flaw and how widely — remain to be clarified by future advisories and incident reports.
Source: BleepingComputer — Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root
