SiteGuard WAF vulnerability exploited to gain root access

Hackers are actively exploiting an OS command-injection vulnerability, identified as CVE-2026-106931, in the SiteGuard Server Edition web application firewall (WAF). The flaw resides in the statistics feature, which is enabled by default in host-based WAF instances.

Successful exploitation allows attackers to execute arbitrary commands with root or SYSTEM privileges on affected machines. The vulnerability affects SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 and later, prior to 8.00 Update 5, as well as FreeBSD versions 2.20 and later, prior to 7.00 Update 6.

EG Secure Solutions has released corrected versions and a patch for installations that cannot be immediately upgraded. JPCERT/CC and the vendor have warned administrators to preserve diagnostic evidence before patching, as the remediation process may erase traces of an attack.