Attackers are exploiting an OS command injection vulnerability in SiteGuard Server Edition, a host-based web application firewall. Successful exploitation may allow commands to run with root privileges on Linux and Unix systems or SYSTEM privileges on Windows hosts.
The vendor has confirmed abuse of CVE-2026-106931, according to reporting published by BleepingComputer on October 18, 2026. The reporting does not establish when the attacks began.
The vulnerability affects the product’s statistics function and can be exploited only when that feature is active. BleepingComputer reports that statistics collection is enabled by default.
Versions affected and fixed
The affected release ranges reported from the vendor’s guidance are:
| Platform and web server | Affected versions | Fixed version |
|---|---|---|
| Apache httpd, Nginx and IIS, excluding FreeBSD | 2.20 and later, before 8.00 Update 5 | 8.00 Update 5 |
| Apache httpd and Nginx on FreeBSD | 2.20 and later, before 7.00 Update 6 | 7.00 Update 6 |
There is a specific IIS exception. According to JPCERT/CC information cited by BleepingComputer, IIS editions from 3.10 through 4.00 Update 4, inclusive, are not affected.
Customers with direct support contacts were notified on September 29, the vendor said. The available reporting does not attach a year to that date.
Commands can inherit the WAF host’s highest privileges
The NVD description classifies the issue as an OS command injection vulnerability. It is mapped to CWE-78 and has a CVSS 3.0 score of 7.8, with the vector:
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
That vector describes a local attack requiring low privileges and no user interaction, with potentially high impact on confidentiality, integrity and availability. The vendor and JPCERT/CC characterize the flaw as critical, as cited in the October 18 report.
Because SiteGuard Server Edition runs on the protected host, injected commands may execute as root on Linux or Unix and as SYSTEM on Windows. Those privileges could give an attacker extensive control over the machine running the WAF.
The available warnings do not identify the operators behind the attacks or describe a specific exploitation chain.
Preserve diagnostics before applying the fix
Administrators should upgrade to 8.00 Update 5 or 7.00 Update 6, depending on the platform. For installations that cannot be upgraded, the vendor provides a patch replacing files involved in statistics processing, including for end-of-life releases.
Before updating or applying that patch, the vendor advises administrators to preserve diagnostic data because remediation may remove evidence of an attack. The reported procedure is:
Web management screen → Diagnostic information → Download diagnostic information
Operators should collect that package first, then install the appropriate fixed release or patch. The statistics function must be active for the vulnerable behavior to be reachable.
The vendor says SiteGuard protects more than 1.5 million websites. Separately, WordPress.org statistics cited by BleepingComputer show the product active on 500,000 sites; that figure is not a count of vulnerable installations.
