Actively Exploited WAF Flaw
Attackers are exploiting a critical vulnerability in SiteGuard, a Japanese-made web application firewall that protects an estimated 1.5 million websites globally, including roughly 500,000 active WordPress installations. Tracked as CVE-2026-106931, the flaw is an OS command-injection bug in the statistics feature of SiteGuard Server Edition, and the vendor has confirmed it is already being exploited in the wild.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-106931 |
| Vulnerability Type | OS Command Injection |
| Component | Statistics feature (enabled by default) |
| Severity | Critical |
| Exploitation Status | Active, in the wild |
Affected Versions
- SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD builds): versions 2.20 through 8.00 Update 4
- FreeBSD builds: versions 2.20 through 7.00 Update 5
- IIS editions 3.10 through 4.00 Update 4 are not affected
Exploitation requires the product's built-in statistics function to be active — a setting that ships enabled by default, putting the vast majority of deployments at risk without any configuration change on the administrator's part.
What We Know About the Attacks
Details remain limited on who is behind the exploitation, how many organizations have been hit, or the exact exploitation technique being used in the wild. The vendor quietly notified direct support customers on September 29, roughly three weeks before public disclosure, giving a subset of customers a head start on remediation.
Remediation
- Upgrade to a patched version of SiteGuard Server Edition, or apply the vendor's file-replacement fix for the statistics-processing component
- Preserve diagnostic evidence before patching — the vendor specifically recommends downloading and retaining the "Diagnostic information" export from the web management interface first, in case forensic review of a prior compromise is needed
- Where immediate patching isn't possible, disable the statistics feature to remove the exploitable code path
- Review server logs for unexpected process spawns or command execution originating from the WAF's statistics component
Why This Matters
SiteGuard sits directly in the request path for hundreds of thousands of sites specifically because it's supposed to be the defensive layer — a WAF being remotely exploitable for root/SYSTEM command execution turns a security control into an attacker's easiest way in. Given the install base, the default-enabled vulnerable feature, and confirmed active exploitation, organizations running SiteGuard Server Edition should treat this as an urgent, same-week patching priority rather than routine maintenance.