Attackers Exploit SiteGuard WAF Vulnerability

Attackers are exploiting CVE‑2026‑106931, an OS command‑injection vulnerability in the statistics feature of SiteGuard Server Edition. The flaw lets them execute commands with root or SYSTEM privileges on the affected web server. It is rated 8.5 on CVSS 4.0 and 7.8 on CVSS 3.0 and requires only local access and low‑level privileges, so it can be used after an attacker has already gained access to a system.

SiteGuard’s advisory says that versions 2.20 and later before 8.00 Update 5 on Apache, Nginx and IIS (excluding FreeBSD) and before 7.00 Update 6 on FreeBSD with Apache or Nginx are vulnerable, while IIS 3.10‑4.00 Update 4 is not. A patch that replaces the statistics files is available even for end‑of‑life versions, but administrators are warned that remediation may erase attack traces and should download the diagnostic information first. The vendor notified customers with direct support contracts on September 29, and the flaw is already being exploited in the wild, though the scale and identities of attackers remain unknown.