Hackers exploit SiteGuard WAF flaw to run commands as admins

CVE-2026-106931 is an OS command injection vulnerability found in the statistics function of SiteGuard Server Edition, a host-based web application firewall. This function is enabled by default and affects versions 2.20 and later before 8.00 Update 5 on Apache httpd, Nginx, and IIS (excluding FreeBSD), and versions 2.20 and later before 7.00 Update 6 on FreeBSD. IIS editions 3.10 through 4.00 Update 4 are not affected. Exploitation allows attackers to run commands as SYSTEM or root on affected servers. The vulnerability is confirmed to be exploited in the wild. The vendor has released patches and offers file replacements for end-of-life versions. Administrators are advised to preserve diagnostic information before patching as remediation may erase attack traces.

Successful exploitation grants attackers the ability to execute arbitrary OS commands with SYSTEM or root privileges on affected servers, potentially leading to full system compromise. The vulnerability is actively exploited in the wild, increasing the risk to organizations using vulnerable SiteGuard Server Edition versions with the statistics feature enabled.

The vendor has released official patches for the affected versions of SiteGuard Server Edition. Administrators should apply these updates promptly. For installations that cannot be upgraded, the vendor provides a patch that replaces files used in statistics processing, including for end-of-life versions. Before applying patches or updates, administrators should download and preserve diagnostic information from the web management interface to retain evidence of attacks, as remediation may erase attack traces.