573/69 Tuesday, October 20, 2026
Reports have confirmed active exploitation of CVE-2026-106931 in SiteGuard Server Edition, a server-based Web Application Firewall (WAF). The vulnerability is an OS Command Injection flaw affecting the Statistics function, which is enabled by default. Successful exploitation could allow attackers to execute commands on affected systems with root or SYSTEM privileges. The developer and JPCERT/CC have confirmed that the vulnerability has been exploited in the wild. However, no information has been disclosed regarding the threat actors, targets, scope of the attacks, or the method used to gain access to affected systems.
The vulnerability affects SiteGuard Server Edition for Apache httpd, Nginx, and IIS from version 2.20 through versions prior to 8.00 Update 5. For Apache httpd and Nginx running on FreeBSD, versions 2.20 through versions prior to 7.00 Update 6 are affected. Exploitation is possible when the Statistics function is enabled. SiteGuard Server Edition for IIS versions 3.10 through 4.00 Update 4 is not affected by this vulnerability.
Administrators should verify the version currently in use and update to version 8.00 Update 5, or to version 7.00 Update 6 for FreeBSD systems, as appropriate for the deployed platform. For systems that cannot be updated immediately, the developer has released patches that modify files used by the Statistics function, including patches for some versions that have already reached end of support. Before applying updates or patches, administrators should download and preserve Diagnostic Information from the management interface as evidence, as the remediation process may remove traces associated with exploitation from the affected system.