• 4 min read
SiteGuard’s statistics feature makes WAF patching an incident-response task
An actively exploited SiteGuard command-injection flaw can execute commands as root or SYSTEM. Its default-enabled statistics feature makes version checks and evidence capture urgent.
Image: BleepingComputer
A web application firewall sits between an application and hostile traffic. With CVE-2026-106931, SiteGuard Server Edition WAF can provide a path to operating-system command execution with root or SYSTEM privileges.
The vulnerability is an OS command-injection issue in the product’s statistics function. SiteGuard says exploitation has already been confirmed, and Japan’s JPCERT/CC has flagged attacks in the wild. Organizations running affected instances should treat this as an incident-response issue rather than routine maintenance that can wait for the next change window.
“An OS command injection vulnerability (CVE-2026-106931) has been found in the statistics function of SiteGuard Server Edition. Abuse has already been confirmed.”
The statistics function is enabled by default. Successful exploitation is possible when it is active, so administrators should establish their precise SiteGuard build, host platform, and statistics configuration before treating an installation as out of scope. The vendor’s official security alert contains the remediation notice.
Which SiteGuard deployments need remediation
The vulnerable range is divided by operating system rather than web server alone. Apache httpd, Nginx, and IIS deployments other than FreeBSD require 8.00 Update 5; FreeBSD Apache and Nginx deployments have a separate fixed point at 7.00 Update 6. The split matters for fleets managed by a single policy across mixed Unix and Windows hosts.
Recommended reading
Bankruptcy courts can file cases but can’t deliver notices
Sergey Kuznetsov • • 6 min read
| SiteGuard Server Edition deployment | Vulnerable versions | Fixed or unaffected status |
|---|---|---|
| Apache httpd, Nginx, or IIS, excluding FreeBSD | 2.20 and later, before 8.00 Update 5 | Update to 8.00 Update 5 |
| Apache httpd or Nginx on FreeBSD | 2.20 and later, before 7.00 Update 6 | Update to 7.00 Update 6 |
| IIS versions 3.10 through 4.00 Update 4 | Not affected | No remediation for this CVE stated |
The IIS exception is narrow: JPCERT/CC identifies IIS 3.10 through 4.00 Update 4, inclusive, as unaffected. It does not apply to every IIS deployment, because later affected IIS releases are included in the non-FreeBSD version range.
SiteGuard offers a patch for systems that cannot be upgraded, including end-of-life releases. The patch replaces files used for statistics processing. It is available for legacy systems, but an attacker who reaches the vulnerable command-injection path can execute commands with the host’s highest-level account privileges.
Preserve evidence before changing the system
The vendor warns that upgrading or applying the patch can erase evidence of an attack. Its prescribed first step is to collect Diagnostic information from the management interface: Web management screen -> Diagnostic information -> Download diagnostic information.
Because exploitation is confirmed, patching alone cannot determine whether a host was compromised before remediation. The supplied reporting does not identify the attackers, victims, attack volume, or the specific commands used after access. It also does not establish whether exposed management interfaces, particular configurations, or a separate prerequisite were involved. Those facts remain unresolved.
SiteGuard says customers with direct support contacts were notified on September 29, 2026. Organizations that depend on channel support or manage inherited WAF deployments should not assume they received that notice. Inventory should include Server Edition instances installed as part of web-server build images, not only systems tracked as security appliances.
The installed-base figures are not an exposure count
SiteGuard says it protects more than 1.5 million websites, while WordPress.org statistics place the product on 500,000 sites. Neither figure establishes the number of vulnerable hosts. The CVE is specific to SiteGuard Server Edition, restricted to stated version ranges and platforms, and contingent on the statistics function being active.
The figures show why confirmed exploitation extends beyond any one Japanese deployment. A host-based WAF often sits on an internet-facing application server; root or SYSTEM execution on that host is more consequential than a WAF rule bypass. The reporting does not provide independent technical details of the exploit chain, so there is no basis to assess reliability, required request structure, or whether network controls mitigate the vulnerable path.
This is similar to an issue already documented in critical infrastructure software, including Cisco ISE’s unauthenticated root-level flaw. The products and vulnerabilities differ, but when a security control may yield privileged code execution and exploitation is confirmed, evidence collection and containment belong in the same maintenance window as the fix.
SiteGuard’s patch covers end-of-life versions, removing one reason to defer remediation. It remains unknown how many compromised hosts may already have had their forensic traces altered by a rushed upgrade or patch.
Frequently asked questions
Which SiteGuard versions are affected by CVE-2026-106931?+
Non-FreeBSD Apache httpd, Nginx, and IIS versions from 2.20 through before 8.00 Update 5 are affected. FreeBSD Apache and Nginx versions from 2.20 through before 7.00 Update 6 are affected when statistics is active.
Are any IIS SiteGuard versions unaffected?+
Yes. IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected according to JPCERT/CC.
Can unsupported SiteGuard versions be fixed?+
SiteGuard provides a patch that replaces statistics-processing files, including for end-of-life versions that cannot be upgraded.
What should administrators do before applying the SiteGuard fix?+
SiteGuard recommends downloading Diagnostic information from the web management interface before updating or patching because remediation may erase evidence of an attack.
Editor-in-Chief
Sergey Kuznetsov is Head of Product at iXBT.com, one of the largest Russian-language technology media outlets, and the founder of itzine.ru. He has spent over a decade building and running tech newsrooms. At for(geeks) he sets editorial standards and reviews what ships.
