SiteGuard WAF Command Injection Under Active Exploitation Grants Root and SYSTEM Access (CVE-2026-106931)

Scope: SiteGuard Server Edition Web Application Firewall, host-based instances with the statistics function enabled

Severity: Red

SiteGuard is a leading Japanese web application firewall that the vendor claims protects more than 1.5 million websites, which makes an actively exploited critical flaw in it worth attention well beyond Japan given how widely vendor software like this gets resold and deployed across regions. CVE-2026-106931 is an OS command injection vulnerability in the statistics feature, which is enabled by default on host-based instances, allowing attackers to execute arbitrary commands with root or SYSTEM privileges. Both the vendor’s own bulletin and Japan’s national CERT have confirmed real-world abuse is already underway. There is a particular irony in a web application firewall, a tool deployed specifically to stop this kind of attack, itself becoming the entry point. Organisations running SiteGuard Server Edition must apply the vendor’s patch immediately, and where that cannot happen right away, disable the statistics function entirely as an interim step.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.