Hackers Exploit SiteGuard WAF Vulnerability for Full Server Control

Hackers are actively exploiting a critical command injection vulnerability, identified as CVE-2026-106931, within the SiteGuard Server Edition Web Application Firewall (WAF). This flaw poses a significant risk, as it can allow attackers to execute operating system commands with elevated privileges, potentially leading to complete compromise of the affected server. The vulnerability resides within the product's statistics function, which is enabled by default, making a broad range of installations susceptible.

EG Secure Solutions, the vendor, confirmed the exploitation of this vulnerability and proactively notified customers with direct support contracts on September 29, 2026. This confirmation was followed by official advisories from Japan's vulnerability coordination service (JVN) on October 14, 2026, and an alert from JPCERT/CC, underscoring the severity and active threat posed by CVE-2026-106931.

The vulnerability is classified under CWE-78 as an OS command injection flaw. It enables attackers to inject and execute arbitrary OS commands through the WAF's statistics-processing function. Crucially, these commands can be executed with root privileges on Unix-based systems or SYSTEM privileges on Windows, far exceeding the attacker's initial permissions. While the published severity ratings indicate a local attack vector requiring low privileges and no user interaction, this pathway from limited access to high-level control is a significant concern for administrators.

According to CVSS v4.0 scoring, the vulnerability is rated at 8.5, and under CVSS v3.0, it scores 7.8. Neither the vendor nor the advisories have yet identified the specific threat actors involved, the number of affected organizations, the scale of attacks, or the precise methods being used in exploitation. However, the active exploitation underscores the need for immediate attention.

The vulnerability affects SiteGuard Server Edition versions starting from 2.20, specifically when the statistics function is enabled. For installations using Apache, Nginx, and IIS (excluding FreeBSD), administrators should upgrade to version 8.00 Update 5. For FreeBSD installations running Apache or Nginx, the recommended upgrade is to version 7.00 Update 6. Notably, IIS editions from version 3.10 through 4.00 Update 4 on Windows are not affected, highlighting the importance of checking both the installed version and the statistics setting.

Organizations unable to perform an immediate upgrade can apply a vendor-provided patch that replaces the specific files responsible for statistics processing. This patching option is also available for releases that are outside their standard support lifecycle. The vendor emphasizes that before applying any update or patch, administrators must save diagnostic information. This step is crucial as the remediation process may erase evidence of an attack, and preserving this data is vital for subsequent incident response and forensic analysis.

Given that exploitation is confirmed, affected organizations are urged to prioritize preserving any available diagnostic data and to promptly implement the necessary fixes. This incident serves as a stark reminder of the persistent threats targeting security appliances and the critical importance of timely patching and robust incident response planning. Staying vigilant and updating defenses as soon as new threats emerge is paramount in today's cybersecurity landscape.