SiteGuard WAF

Attackers are exploiting a vulnerability in the SiteGuard web application firewall to execute commands with administrator privileges on affected systems. The flaw allows intruders to bypass the firewall's protections and run arbitrary commands as admin. BleepingComputer reports the attacks are actively underway, and organizations running SiteGuard WAF are urged to apply patches or mitigations immediately to prevent server compromise.

Security firm EG Secure Solutions reported an actively exploited OS command injection vulnerability, tracked as CVE-2026-106931, in SiteGuard Server Edition's statistics feature. The flaw lets attackers run commands with root on Linux and SYSTEM on Windows, giving full administrative control over protected servers. Administrators are being urged to patch immediately, as exploitation in the wild means internet-facing WAF deployments are considered at direct risk.