A web application firewall is supposed to stand in front of a website and block attacks. In this case, the firewall itself became the entry point. Hackers are actively exploiting a critical OS command-injection vulnerability in SiteGuard Server Edition, tracked as CVE-2026-106931, which can let attackers run operating system commands with root privileges on Unix systems or SYSTEM privileges on Windows.

Which versions are affected

The flaw sits in the product's statistics function, which is enabled by default. According to the vendor, SiteGuard Server Edition for Apache, Nginx and IIS versions 2.20 and later, before 8.00 Update 5, are vulnerable, as are FreeBSD editions before 7.00 Update 6. IIS editions from 3.10 through 4.00 Update 4 are not affected. For installations that cannot be upgraded, the vendor offers a replacement-file patch for statistics processing, including for end-of-life versions.

A warning before you patch

SiteGuard warns that remediation may erase attack traces, so administrators should download and retain diagnostic information from the web management interface before updating. That step matters: patching first and investigating second can destroy the evidence needed to tell whether a server was already compromised. The vendor notified customers with direct support contracts on 29 September, and Japan's CERT coordination body issued a public warning on 14 October.

What to do now

Upgrade to the fixed release or apply the vendor's replacement patch, preserve diagnostics first, and then investigate any internet-facing server that was running a vulnerable version. Because the firewall runs on the same host as the web server it protects, a compromise here can expose the whole server, so defenders should also review accounts, scheduled tasks and recently changed files for signs of intrusion.