Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM, root

Attackers are exploiting an OS command-injection flaw, CVE-2026-106931, in the statistics feature of SiteGuard Server Edition, which is enabled by default. Successful exploitation allows commands to run with root or SYSTEM privileges; versions 2.20 and later before 8.00 Update 5 are affected.

• CVE-2026-106931 is an OS command injection in SiteGuard's statistics feature
• Exploitation yields command execution as root or SYSTEM
• Affected: versions 2.20 to before 8.00 Update 5, FreeBSD to before 7.00 Update 6
• SiteGuard claims to protect over 1.5 million websites