SiteGuard WAF Bug Exploited: How a Stats Feature Gave Root

Attackers are exploiting CVE-2026-106931 in SiteGuard Server Edition, a host based web application firewall, to run operating system commands as root on Linux and FreeBSD or as SYSTEM on Windows. The bug sits in the statistics feature, which ships enabled by default and has been vulnerable since version 2.20. The vendor and Japan's JPCERT/CC both confirm active exploitation.

The details here come from the EG Secure Solutions advisory published 14 October 2026, JPCERT/CC alert JPCERT-AT-2026-0032 and JVN#88474777, and BleepingComputer reporting on 18 October that exploitation is ongoing.

What was exploited?

SiteGuard installs as a module inside the web server. A bug in the WAF lands the attacker on the very host it protects, with the highest privilege on the system.

Why did a local bug become a host takeover?

The CVSS vector lists the attack as local with low privileges, which reads as limited. The impact is what advances it. Injected commands run as root or SYSTEM, so any low privileged foothold on the server becomes full control of the host operating system. That foothold could be a compromised web user, a vulnerable application that gives code execution as www-data, or any other access that places the attacker on the machine.

EG Secure Solutions and JPCERT/CC have not disclosed the mishandled input, payloads, or attacker identities. The vendor notes SiteGuard protects about 1.5 million websites, but not the compromised count.

I have seen this on hosts where a WAF runs as root to inspect traffic. The review I now run is the same one from container permission denied file exists and debug distroless container no shell: what user does the product run as, and what happens if its parser is wrong?

Why did some customers learn two weeks early?

EG Secure Solutions notified customers with direct support contracts on 29 September, about two weeks before the public advisory on 14 October. JPCERT/CC and the Japan Vulnerability Notes coordinated the public disclosure and published JVN#88474777 the same day as the vendor advisory. Customers without a direct support contract received the warning with everyone else on 14 October.

That window matters because exploitation is confirmed and its start date is not disclosed. A server patched on 15 October may have been exposed during the private period.

What should you save before you patch?

This is the unusual part of this response. EG Secure Solutions says updating or patching may remove evidence of an attack. Before remediation, use the web management interface to download and retain diagnostic information: Web management screen then Diagnostic information then Download diagnostic information. Keep that bundle off the host.

JPCERT/CC also advises preserving evidence and considering a compromise investigation. Disabling statistics only closes the path. I tested the save first pattern on a lab Apache host. The bundle is small and contains the statistics processing logs.

According to SecurityOnline, JPCERT/CC issued its emergency alert on 14 October and warned that an attacker with low privileges could execute arbitrary commands with high privilege. According to BleepingComputer, exploitation was already underway when the public advisory landed.

What should you patch or disable right now?

Patch to the fixed build. For Apache httpd, Nginx and IIS outside FreeBSD, that is 8.00 Update 5. For FreeBSD Apache httpd and Nginx, that is 7.00 Update 6. If you cannot upgrade immediately, apply the vendor file replacement patch for your branch, and consult the vendor advisory for the exact replacement steps for end of life versions.

If you cannot patch today, disable statistics as an interim workaround. After patching, review the host for compromise because root access survives a statistics file replacement. Look for unexpected root processes, outbound connections, and web root files. At Krova Cloud we treat any host that must run as root as disposable.

What is the verdict and what remains uncertain?

According to JPCERT/CC, an attacker with low privileges can obtain high privilege on the host. According to EG Secure Solutions, abuse has already been confirmed. The fix is specific: update, file replacement patch, or disable statistics, in that order.

The verdict is that any host where SiteGuard's statistics feature was enabled and which could be reached by a low privileged user should be treated as potentially compromised until the diagnostic bundle is reviewed. Patching stops the next attempt. It does not undo the last one.

The limitations are threefold. First, no indicators of compromise such as hashes, IPs, or payloads have been published, so searching for known bad is not yet possible. Second, the scale of exploitation is not disclosed, so you cannot infer exposure from absence of public victim lists. Third, the CVSS scores of 8.5 and 7.8 underrate the practical impact because they score the entry as local even though the result is root.

FAQ

Is this remote code execution?

Not directly. The attacker needs local access with low privileges first. The flaw then turns that limited access into root or SYSTEM. In practice many web servers provide that initial foothold through a separate application vulnerability.

Which versions are safe?

Outside FreeBSD, Apache httpd, Nginx and IIS are safe at 8.00 Update 5. On FreeBSD, Apache httpd and Nginx are safe at 7.00 Update 6. IIS 3.10 through 4.00 Update 4 was never affected. Earlier than 2.20 is not affected either, but those builds are outdated for other reasons.

Should I just disable statistics and stay on my current version?

Disable statistics only as a temporary workaround. Plan to move to the fixed build or apply the file replacement patch. An enabled by default feature that gave root once suggests the component deserves an actual fix, not a toggle.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud