Attackers are exploiting CVE-2026-106931, an OS command-injection flaw in the statistics feature of SiteGuard Server Edition, a host-based web application firewall. According to BleepingComputer, the bug lets them run commands with root or SYSTEM privileges, and the feature is enabled by default. The vendor and Japan’s CERT agency both rate it critical and confirm exploitation in the wild.

Why a WAF bug hurts more than most

A web application firewall sits in front of the sites it protects, and a host-based one runs on the same server as the application. That position makes it a high-value target. If an attacker controls the WAF process at the highest privilege level, they control the machine, and probably the traffic and logs that the WAF was meant to guard.

Reach adds to the concern. SiteGuard says it protects more than 1.5 million websites, and WordPress.org statistics put the product on 500,000 active sites. Those figures describe the install base, not the number of vulnerable or compromised systems. Nobody has published how many servers are affected.

What we do not know

Neither the vendor bulletin nor the JPCERT/CC warning names the attacker, the victims, the scale of the attacks or the techniques used. That gap matters for defenders. Without indicators of compromise, teams cannot easily tell whether they were hit before patching.

The timeline adds another question. The vendor says customers with direct support contacts learned of the flaw on September 29. The public alerts came later, and BleepingComputer reported on October 18. Anyone outside that direct-contact group may have had a shorter window to react, though the sources do not say when exploitation began.

Patching without destroying evidence

The vendor gives unusual forensic advice: remediation may erase attack traces, so administrators should save evidence first. The step is to download the diagnostic information from the web management interface before updating or patching. For a flaw already under attack, that order of operations is sensible. Teams that patch first may fix the hole and lose the only record of whether someone used it.

Scope also matters. JPCERT/CC notes that IIS editions 3.10 through 4.00 Update 4 are not affected. Exploitation requires the statistics function to be active. For installations that cannot be upgraded, including end-of-life versions, the vendor offers a patch that replaces the files used in statistics processing.

The wider pattern

This is the latest in a run of exploited flaws in security and infrastructure products. BleepingComputer’s related coverage lists a Check Point Security Gateway VPN remote code execution bug and a BeyondTrust zero-day exploited since August. Defensive tools usually run with broad privileges and face the internet, so one input-handling mistake can be severe.

Optional-looking features like statistics pages are a common weak spot because they add parsing code and sometimes shell calls. Default-on status means many deployments carry the risk without anyone choosing it.

What to watch next

  • Whether the vendor or JPCERT/CC publish indicators of compromise or details of the attacks.
  • Whether the flaw appears in vulnerability catalogues used to prioritise patching.
  • How many end-of-life deployments remain and rely on the file-replacement patch.
  • Reports of follow-on compromise on sites that ran vulnerable versions.

For now, affected teams should preserve diagnostic data, apply the fix and treat any exposed server with the statistics function active as potentially compromised until shown otherwise.

Sources