SiteGuard Server Edition WAF flaw CVE-2026-106931 exploited in the wild for root/SYSTEM command execution
EG Secure Solutions warns that CVE-2026-106931, an OS command injection flaw in the statistics function of SiteGuard Server Edition, a Japanese host-based WAF, is being exploited in the wild. Successful exploitation lets an attacker run commands as root or SYSTEM on the server hosting the product. The flaw is rated CVSS 4.0 8.5 and CVSS 3.0 7.8, and it requires local access with low privileges, so it is likely used after an initial foothold. The vendor confirmed exploitation but the advisories name no attackers or victims, give no attack method and no scale of impact. Applying the update may erase traces of compromise, so administrators are told to save diagnostic information first.
Detalhes técnicos
- Vulnerable component: the statistics feature, enabled by default; only installs with it enabled are exposed.
- Affected: version 2.20 or later; on Apache, Nginx and IIS (excluding FreeBSD) anything before 8.00 Update 5.
- Affected: FreeBSD with Apache or Nginx before 7.00 Update 6.
- Not affected: IIS editions 3.10 through 4.00 Update 4.
- Timeline: customers with direct support contracts were notified on September 29; the public alert and JVN advisory followed on October 14. The vendor reported to IPA and JPCERT/CC coordinated disclosure. Customers without direct support contracts were warned about two weeks later.
Remediação
- Before updating, download and save the "Diagnostic Information" from the web management screen, as patching may erase attack traces.
- Upgrade to 8.00 Update 5 (Apache, Nginx, IIS) or 7.00 Update 6 (FreeBSD with Apache or Nginx).
- If upgrading is not possible, apply the vendor patch that replaces the statistics processing files; it also covers end-of-life versions.
- Check systems for signs of compromise and investigate suspicious activity.
Linha do tempo
-
SiteGuard Server Edition WAF flaw CVE-2026-106931 exploited in the wild for root/SYSTEM command execution
The article adds that the vendor has confirmed exploitation, and that customers without direct support contracts were warned about two weeks after those with contracts. It also stresses that the advisories do not identify attackers, victims, attack method or number of affected systems.
ler a análise desta fonte ocultar
The article adds that the vendor has confirmed exploitation, and that customers without direct support contracts were warned about two weeks after those with contracts. It also stresses that the advisories do not identify attackers, victims, attack method or number of affected systems.
EG Secure Solutions warns that CVE-2026-106931, an OS command injection flaw in the statistics function of SiteGuard Server Edition, a Japanese host-based WAF, is being exploited in the wild. Successful exploitation lets an attacker run commands as root or SYSTEM on the server hosting the product. The flaw is rated CVSS 4.0 8.5 and CVSS 3.0 7.8, and it requires local access with low privileges, so it is likely used after an initial foothold. The vendor confirmed exploitation but the advisories name no attackers or victims, give no attack method and no scale of impact. Applying the update may erase traces of compromise, so administrators are told to save diagnostic information first.
Technical Details
- Vulnerable component: the statistics feature, enabled by default; only installs with it enabled are exposed.
- Affected: version 2.20 or later; on Apache, Nginx and IIS (excluding FreeBSD) anything before 8.00 Update 5.
- Affected: FreeBSD with Apache or Nginx before 7.00 Update 6.
- Not affected: IIS editions 3.10 through 4.00 Update 4.
- Timeline: customers with direct support contracts were notified on September 29; the public alert and JVN advisory followed on October 14. The vendor reported to IPA and JPCERT/CC coordinated disclosure. Customers without direct support contracts were warned about two weeks later.
Remediation
- Before updating, download and save the "Diagnostic Information" from the web management screen, as patching may erase attack traces.
- Upgrade to 8.00 Update 5 (Apache, Nginx, IIS) or 7.00 Update 6 (FreeBSD with Apache or Nginx).
- If upgrading is not possible, apply the vendor patch that replaces the statistics processing files; it also covers end-of-life versions.
- Check systems for signs of compromise and investigate suspicious activity.
-
SiteGuard Server Edition WAF flaw CVE-2026-106931 exploited in the wild; patching may erase evidence of compromise
Adds details not in the existing case: CVSS scores (4.0 8.5 and 3.0 7.8), JVN's description of the required access as local with low privileges rather than unauthenticated remote, the option of disabling the statistics feature as a workaround, the public JVN advisory date of October 14 and IPA/JPCERT/CC coordination, and guidance on handling evidence before patching.
ler a análise desta fonte ocultar
Adds details not in the existing case: CVSS scores (4.0 8.5 and 3.0 7.8), JVN's description of the required access as local with low privileges rather than unauthenticated remote, the option of disabling the statistics feature as a workaround, the public JVN advisory date of October 14 and IPA/JPCERT/CC coordination, and guidance on handling evidence before patching.
EG Secure Solutions warns that CVE-2026-106931, an OS command injection flaw in the statistics function of SiteGuard Server Edition (a host-based WAF), is being exploited in the wild, and that applying the fix may erase traces of earlier attacks. Successful exploitation may allow command execution as root on Linux/FreeBSD or SYSTEM on Windows. The flaw is rated CVSS 4.0 8.5 and CVSS 3.0 7.8. JVN describes the required access as local with low privileges, not an unauthenticated remote flaw. The advisories name no malware, attacker, victim or attack method, and publish no IOCs.
Technical Details
- Vulnerable component: the statistics feature, enabled by default.
- Affected: version 2.20 and later with statistics enabled; for Apache httpd, Nginx and IIS, versions before 8.00 Update 5.
- Affected: Apache httpd and Nginx on FreeBSD before 7.00 Update 6.
- Not affected: IIS versions 3.10 through 4.00 Update 4.
- Timeline: customers with direct support contracts were notified on September 29, 2026; the public JVN advisory followed on October 14, with the developer reporting to IPA and JPCERT/CC coordinating.
Remediation
- Before updating, download and securely store the diagnostic information from the web management screen, recording when and where it was collected.
- Preserve relevant system and security logs and investigate for compromise before making changes.
- Upgrade to 8.00 Update 5 (Apache httpd, Nginx, IIS) or 7.00 Update 6 (Apache httpd, Nginx on FreeBSD).
- The vendor also provides a patch replacing statistics processing files, including for some end-of-life versions.
- Disabling the statistics feature can avoid exposure per JPCERT/CC; confirm the steps with the vendor.
- Keep monitoring the host for unexpected command execution after remediation.
-
SiteGuard Server Edition WAF OS command injection flaw CVE-2026-106931 exploited in the wild for root/SYSTEM command execution
ler a análise desta fonte ocultar
Threat actors are exploiting CVE-2026-106931, a critical OS command injection vulnerability in the statistics function of the SiteGuard Server Edition web application firewall, to run commands with root or SYSTEM privileges. The statistics feature is enabled by default. Both the vendor's bulletin and a warning from JPCERT/CC confirm in-the-wild abuse. The attacker's identity, the victims, the scale of the attacks and the techniques used have not been disclosed. SiteGuard is a leading Japanese WAF vendor that claims to protect more than 1.5 million websites, and the product is active on about 500,000 sites according to WordPress.org statistics. The vendor says customers with direct support contacts were notified on September 29.
Technical Details
- Vulnerable component: the statistics function of host-based SiteGuard Server Edition WAF instances. Exploitation requires the statistics function to be active.
- Affected: Server Edition for Apache httpd, Nginx and IIS (excluding FreeBSD), versions 2.20 and later, before 8.00 Update 5.
- Affected: Server Edition for Apache httpd and Nginx on FreeBSD, versions 2.20 and later, before 7.00 Update 6.
- Not affected: IIS editions 3.10 through 4.00 Update 4, inclusive (per JPCERT/CC).
- No IOCs have been published in the vendor or JPCERT/CC advisories.
Remediation
- Upgrade to a fixed version: 8.00 Update 5 or later, or 7.00 Update 6 or later on FreeBSD.
- Where upgrading is not possible, including end-of-life versions, apply the vendor patch that replaces the files used in statistics processing.
- Remediation may erase attack traces. Before updating or patching, preserve evidence by downloading the diagnostic information (Web management screen -> Diagnostic information -> Download diagnostic information).
- Treat exposed instances as potentially compromised and hunt for signs of abuse.