-
Hackers have been making use of CVE-2026-106931, which is an OS command-injection vulnerability in SiteGuard Server Edition.
-
This issue affects the built-in statistics functions and grants the attackers root or SYSTEM access.
-
System administrators should either perform an upgrade, or apply a vendor patch, but first need diagnostic evidence.
Hackers have discovered a critical flaw in SiteGuard Server Edition that allows them to perform commands and gain root or system level access on the affected servers.
This vulnerability goes by the name of CVE-2026-106931. It affects the statistics feature in SiteGuard’s host-based web application firewall, or WAF.
What the flaw does
SiteGuard Server Edition is a host-based WAF. A WAF protects websites by filtering harmful web traffic before it reaches applications. The flaw sits in the statistics feature of the product. This feature is enabled by default, so many installations may be exposed.
An attacker can inject operating system commands through the vulnerable function. The commands take place at the root level on the Linux platform and the SYSTEM level on Windows.
Whether it is Linux or Windows, having access to the root/SYSTEM privileges gives hackers the greatest control over the affected system. They will be able to view files stored on the system, modify system settings, and deploy malware.
According to the cyber-security agency of Japan called JPCERT/CC, the exploitation of this vulnerability is of critical nature. The agency says attackers have already exploited the flaw in real attacks.
Additionally, the developer of SiteGuard, EG Secure Solutions, also has confirmed acts of exploitation of the flaw. However, the developer has not released any further information including names of attackers, their victims and their techniques.
Lack of publicly available details severely complicates gauging the impact of the issue. However, security teams should still be wary as the exploited systems still present a high risk.
OS command injection is when an application takes untrusted input and passes it to an operating system command. Attackers insert either special characters or commands into the input that the program gives to the OS command. The system then runs the malicious command as part of the normal process.
Which versions are affected
The flaw affects SiteGuard Server Edition for Apache httpd, Nginx, and IIS. It affects versions 2.20 and later, but not versions before 8.00 Update 5.
It also affects SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD. These versions include 2.20 and later, but not versions before 7.00 Update 6. The issue only occurs when the statistics feature is active. The feature is switched on by default.
IIS editions from 3.10 through 4.00 Update 4 are not affected. Administrators running those versions do not need to take action for this flaw. SiteGuard says it protects more than 1.5 million websites. WordPress.org data also shows that its plugin remains active on about 500,000 sites.
The wide use of SiteGuard increases the importance of the patch. Many websites may run older versions that still contain the flaw. Administrators should check their exact product edition and version before updating. They should also confirm whether their installation uses Apache, Nginx, IIS, or FreeBSD.
How admins should respond
Administrators should update SiteGuard Server Edition immediately. The fix is available in version 8.00 Update 5 for Apache, Nginx, and IIS. FreeBSD users should update to version 7.00 Update 6. These updates remove the command-injection weakness in the statistics feature.
Organizations that cannot upgrade can apply a vendor patch. The patch replaces files used in statistics processing. The patch also supports end-of-life versions. This helps organizations that still run older SiteGuard installations.
EG Secure Solutions says updating or patching may erase evidence of an attack. Thus, it is important for IT administrators to first capture logs and diagnostics information. Administrators have the chance of retrieving diagnostic data from web management pages and should retrieve & save it before fixing any issue.
Further, the security teams should find out if hackers breached their systems before applying patches. This means they should examine access logs and command history, and also scan for any unusual network connection.
If they discover signs of potential compromise, the next step is to change administrator passwords and API keys. They should also isolate affected servers while they investigate.
Why WAF security matters
A web application firewall (WAF) stays before the web applications. It monitors the requests received by the apps and stops typical attacks on the web, such as SQL injection and cross-site request forgery.
Still, a WAF can be a pathway for an attack if it has vulnerabilities. In some cases, perpetrators can attack the WAF directly rather than the site it protects. Linux systems face similar privilege-escalation risks, as demonstrated by the DirtyDecrypt security bug that allows local attackers to gain root privileges.
In this case, the hacker will get the full physical access to the SiteGuard that runs the server. It can result in gaining access to the host sites, their databases, data of customers, and internal systems.
Security teams should always review the server logs to detect unusual commands; also, they should look out for unaccounted processes, changes to system files, or newly created accounts. Organizations should restrict access to the web management interface of SiteGuard. They should also limit administrative access to trusted internal networks.
The vendor notified customers with direct support contracts on September 29. It published the public alert on October 14. It is necessary for the administrators to classify this case as an urgent patch task. Active exploitation implies that attackers may have compromised the SiteGuard installations under attack.
