Cybersecurity professionals and privacy-conscious users should be aware of a severe vulnerability within **SiteGuard Server Edition**, a prominent Japanese web application firewall. ### The Vulnerability: CVE-2026-106931 The flaw, identified as **CVE-2026-106931**, is an OS command-injection vulnerability residing in the statistics feature of host-based **SiteGuard** WAF instances. This feature is enabled by default, making a vast number of installations susceptible. Successful exploitation grants attackers the ability to execute arbitrary commands with root or SYSTEM privileges, giving them complete control over the compromised server. ### Active Exploitation Confirmed Both **SiteGuard** and **Japan's CERT** agency have issued warnings, confirming that **CVE-2026-106931** is being actively exploited in the wild. The severity of this issue is rated as critical. Details regarding the identity of the attackers, specific victims, the scale of the attacks, or the precise methods of exploitation remain undisclosed in the public advisories. ### Affected Versions The following versions of **SiteGuard Server Edition** are vulnerable if their statistics function is active: * **SiteGuard Server Edition** for **Apache httpd**, **Nginx**, and **IIS** (excluding **FreeBSD**) versions 2.20 and later, before 8.00 Update 5. * **SiteGuard Server Edition** for **Apache httpd** and **Nginx** on **FreeBSD** versions 2.20 and later, before 7.00 Update 6. It's important to note that **IIS** editions 3.10 through 4.00 Update 4, inclusive, are not affected, as per **JPCERT/CC**. ### Remediation and Evidence Preservation **SiteGuard** recommends upgrading to a patched version immediately. For installations that cannot be upgraded, a file replacement patch for statistics processing is available, even for end-of-life versions. Administrators are strongly advised to preserve diagnostic information *before* applying any updates or patches, as remediation may erase traces of an attack. This can be done by downloading “Diagnostic information” from the web management interface (Web management screen -> Diagnostic information -> Download diagnostic information). Customers with direct support contacts were reportedly notified of the flaw on September 29.