A command-injection flaw in SiteGuard Server Edition, a web application firewall from a major Japanese vendor, is being actively exploited to execute arbitrary commands with root or SYSTEM-level privileges. The vulnerability, designated CVE-2026-106931, resides in the statistics functionality of host-based WAF deployments where it runs by default.

SiteGuard protects approximately 1.5 million websites according to vendor claims, with WordPress.org data indicating active deployment on 500,000 sites. Both the vendor's security bulletin and an alert from Japan's CERT agency confirm the flaw carries critical severity and is currently under active attack.

The vendor stated: "An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed." However, specifics about the attackers, targeted organizations, attack scope, and exploitation techniques remain undisclosed in available advisories.

Affected Versions

The vulnerability impacts multiple configurations of SiteGuard Server Edition:

  • SiteGuard Server Edition for Apache httpd, Nginx, and IIS (non-FreeBSD systems) versions 2.20 through 8.00 Update 4
  • SiteGuard Server Edition for Apache httpd and Nginx on FreeBSD versions 2.20 through 7.00 Update 5
  • IIS editions 3.10 through 4.00 Update 4 are not vulnerable

Exploitation requires the statistics function to be active on the target system. Organizations running versions prior to the patched releases remain at risk if this feature is enabled.

Remediation Options

For deployments unable to upgrade immediately, SiteGuard offers a file-replacement patch targeting the statistics processing components. This patch is available even for end-of-life product versions.

The vendor cautions that applying patches may overwrite forensic evidence of intrusions. Before implementing fixes, administrators should preserve attack artifacts by downloading and saving diagnostic information through the web management interface (Web management screen → Diagnostic information → Download diagnostic information).

Customers with direct vendor support relationships received notification of the vulnerability on September 29.