Hackers Exploit SiteGuard WAF Vulnerability That Could Give Them Full Control of Servers
Brief
Hackers are exploiting a command injection flaw in SiteGuard Server Edition, a web application firewall installed directly on protected servers.
Tracked as CVE-2026-106931, the vulnerability could let attackers run operating system commands with root or SYSTEM privileges, potentially giving them full control of an affected server.
The flaw affects the product’s statistics function, which is enabled by default. EG Secure Solutions confirmed exploitation and notified customers with direct support contracts on September 29, 2026. Japan’s vulnerability coordination service published its JVN advisory on October 14, while JPCERT/CC also issued an alert.
The weakness is classified as OS command injection under CWE-78. It lets attackers run operating system commands through the affected software’s statistics-processing function.