Hackers exploit SiteGuard WAF flaw to run commands as admins

SiteGuard Server Edition customers are being urged to update or patch after its maker confirmed that attackers are exploiting a command-injection flaw in the web application firewall's statistics feature. The vulnerability, CVE-2026-106931, can let an attacker run operating-system commands with root or SYSTEM privileges on an affected server, according to the vendor's emergency alert. ¹²

What happened

EG Secure Solutions says the vulnerability is already being abused, although the company has not disclosed who is behind the attacks, which organisations have been hit or how widely the campaign has spread. The flaw affects SiteGuard Server Edition installations running version 2.20 or later when the statistics function is enabled — its default setting. ¹

The affected product is used with Apache HTTP Server, Nginx and IIS. For the standard Apache, Nginx and IIS editions, versions before 8.00 Update 5 are vulnerable. FreeBSD Apache and Nginx editions are affected before version 7.00 Update 6. IIS versions 3.10 through 4.00 Update 4 are excluded from the warning, according to JPCERT/CC's advisory. ¹²

What administrators should do

EG Secure Solutions recommends upgrading to a fixed release or applying its patch where an upgrade is not practical. Administrators should first download and preserve the product's Diagnostic Information, because updating or patching may erase traces useful for investigating an intrusion. ¹

The warning matters beyond the vulnerability's CVSS scores. Successful exploitation can affect the confidentiality, integrity and availability of the host server, while the availability of a working exploit means defenders should treat exposed installations as potentially compromised rather than waiting for more campaign details. The vendor says customers with support contracts were notified on 29 September. ¹

Our opinion

This is the sort of security alert administrators should treat as an incident-response task, not a routine version check. The combination of confirmed exploitation, a default-enabled feature and high privileges makes preserving diagnostic information before remediation especially important. The public advisories do not yet identify victims or provide a complete attack chain, so claims about the campaign's scale should remain cautious. For affected teams, the sensible order is to preserve evidence, restrict exposure where possible, then apply the vendor's fixed release or patch and review logs for unexpected command execution. ¹²