Hackers are exploiting an OS command-injection vulnerability in the SiteGuard Server Edition web application firewall, or WAF, to run commands with root or SYSTEM privileges on affected machines. The flaw is tracked as CVE-2026-106931 and affects the statistics feature in host-based WAF instances, which is enabled by default. SiteGuard, a leading Japanese WAF vendor, claims its product protects more than 1.5 million websites, and WordPress.org statistics show it is active on 500,000 sites.
SiteGuard's bulletin and a warning from Japan's CERT agency rate CVE-2026-106931 as critical severity and confirm it is being exploited in the wild. SiteGuard's alert states that an OS command injection vulnerability has been found in the statistics function of SiteGuard Server Edition and that abuse has already been confirmed. Neither advisory identifies the attacker, the victims, the scale of the attacks, or the methods used.
Successful exploitation is possible in the affected versions if the statistics function is active. According to JPCERT/CC, IIS editions 3.10 through 4.00 Update 4, inclusive, are not affected. SiteGuard said customers with direct support contacts were notified of the flaw earlier, on September 29.
For installations that cannot be upgraded, SiteGuard offers a patch that replaces files used in statistics processing, including for end-of-life versions. The vendor warns that remediation may erase traces of an attack and recommends that administrators preserve evidence before updating or patching. Administrators are instructed to download and retain diagnostic information from the web management interface, under Diagnostic information on the Web management screen.
The disclosure leaves key questions unresolved for defenders. Neither advisory names the victims or describes how the attacks are carried out, and the number of compromised machines has not been established publicly. SiteGuard has not said whether the flaw was found internally or reported externally.
The vulnerability matters beyond Japan because SiteGuard is deployed on a large installed base measured in the hundreds of thousands of WordPress sites. Administrators running host-based instances with the statistics feature enabled face the highest exposure, according to the advisories. Patching or applying the file-replacement update is the vendor's recommended path for those who cannot upgrade.
Overall prevention scores can hide what happens after initial access, and once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
More cybersecurity news from TechManNews.
