SiteGuard WAF flaw reportedly exploited to run root or SYSTEM commands

An active statistics function is required for exploitation

BleepingComputer reported that attackers are exploiting CVE-2026-106931, an OS command-injection vulnerability in SiteGuard Server Edition. The flaw affects its statistics function and, when that function is active, can reportedly enable command execution with root or SYSTEM privileges.

The report says affected releases include Apache httpd, Nginx, and IIS editions other than FreeBSD from version 2.20 up to before 8.00 Update 5, plus FreeBSD Apache httpd and Nginx editions from version 2.20 up to before 7.00 Update 6. IIS editions 3.10 through 4.00 Update 4 are described as unaffected.

The supplied report does not establish the prior exploitation status of this vulnerability or provide a comparable earlier attack measure.

The report newly identifies CVE-2026-106931 as under active exploitation and describes the affected SiteGuard Server Edition version ranges. The vendor offers an update or, where upgrades are not possible, a statistics-processing patch; it advises preserving diagnostic information before remediation because attack traces may be erased.

Affected scope varies by version and operating system

The reported exploitation concerns a web application firewall, software intended to protect web applications, while the claimed outcome is command execution at root or SYSTEM privilege on vulnerable servers. The report does not identify attackers, victims, attack scale, or the methods used.