Hackers are exploiting a command injection flaw in SiteGuard Server Edition, a web application firewall installed directly on protected servers.
Tracked as CVE-2026-106931, the vulnerability could let attackers run operating system commands with root or SYSTEM privileges, potentially giving them full control of an affected server.
The flaw affects the product’s statistics function, which is enabled by default. EG Secure Solutions confirmed exploitation and notified customers with direct support contracts on September 29, 2026. Japan’s vulnerability coordination service published its JVN advisory on October 14, while JPCERT/CC also issued an alert.
The weakness is classified as OS command injection under CWE-78. It lets attackers run operating system commands through the affected software’s statistics-processing function.
Those commands may execute with root privileges on Unix systems or SYSTEM privileges on Windows, rather than the attacker’s existing permissions. However, the published severity ratings describe a local attack requiring low privileges and no user interaction.
Hackers Exploit SiteGuard WAF Vulnerability
Administrators should therefore understand this as a path from limited access to higher privileges, not a confirmed login-free remote attack. The vulnerability scores 8.5 under CVSS 4.0 and 7.8 under CVSS 3.0.
Neither advisory identifies the attackers, affected organizations, attack volume, or the exact exploitation method. Similar risks involving security appliances have appeared in Cyber Security News coverage of a Hillstone WAF command injection vulnerability. However, that issue is separate from SiteGuard.
Affected releases start at SiteGuard Server Edition version 2.20 when statistics are enabled. For Apache, Nginx, and IIS editions outside FreeBSD, administrators should upgrade to version 8.00 Update 5. FreeBSD installations using Apache or Nginx should move to version 7.00 Update 6.
There is an important exception for Windows deployments. IIS editions from version 3.10 through version 4.00 Update 4 are not affected. Checking both the installed version and statistics setting is therefore necessary when assessing exposure.
Organizations unable to upgrade can obtain a patch that replaces the files used for statistics processing. The vendor also provides this option for releases whose support has ended.
Administrators must save diagnostic information before installing an update or patch because remediation may erase traces of an attack. In the web management interface, open “Diagnostic Information,” then select “Download Diagnostic Information” and retain the downloaded data before making changes.
This evidence-first approach supports later investigation, as explained in Cyber Security News’ guide to digital forensics and incident response. With exploitation confirmed, affected organizations should preserve diagnostics and promptly apply the appropriate fix.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
