Hackers exploit SiteGuard WAF flaw to run commands as admins

Threat actors are actively abusing a critical OS command-injection bug in the SiteGuard Server Edition web application firewall, letting them run arbitrary commands with root or SYSTEM-level privileges. Tracked as CVE-2026-106931, the flaw lies in the statistics module that ships enabled by default on host-based deployments of this widely used Japanese WAF, which reportedly shields over 1.5 million sites and runs on roughly 500,000 WordPress installs. Both the vendor and Japan's CERT confirm real-world exploitation, though details on the attackers, victims, or attack scale haven't been disclosed. Vulnerable builds include SiteGuard for Apache httpd, Nginx and IIS (non-FreeBSD) prior to 8.00 Update 5, and the FreeBSD-based Apache/Nginx editions before 7.00 Update 6; IIS versions 3.10 through 4.00 Update 4 are unaffected. The vendor urges admins to back up diagnostic data through the web console before applying the fix, since patching may wipe out forensic evidence of prior compromise.