Attackers exploit critical SiteGuard Server Edition flaw, patch urged
The CVE-2026-106931 command-injection bug in SiteGuard Server Edition's statistics feature can give attackers root or SYSTEM access; a patch is available.
Attackers are actively exploiting CVE-2026-106931, an OS command-injection flaw in the statistics function of SiteGuard Server Edition, according to BleepingComputer. Exploitation can let an attacker run commands with root or SYSTEM privileges.
The vulnerability is reachable when the statistics feature, which is enabled by default, is active. Affected builds include SiteGuard Server Edition for Apache httpd, Nginx and IIS (excluding FreeBSD) from version 2.20 onward before 8.00 Update 5, and the Apache httpd and Nginx editions on FreeBSD from version 2.20 onward before 7.00 Update 6.
The vendor has released a patch that replaces the files used in statistics processing, and it covers end-of-life versions as well. IIS editions 3.10 through 4.00 Update 4 are not affected, according to the advisory.
Preserve evidence before patching
SiteGuard advises administrators to save diagnostic information as evidence before applying the fix, because remediation may erase traces of an attack. Customers with direct support contacts were notified of the flaw on September 29, and JPCERT/CC has issued a warning about it.
SiteGuard says its products protect more than 1.5 million websites, and WordPress.org statistics show the product active on 500,000 sites.
Quick answers
What is CVE-2026-106931?
It is an OS command-injection vulnerability in SiteGuard Server Edition's statistics function that can be exploited to run commands with root or SYSTEM privileges.
Which SiteGuard Server Edition versions are affected?
Apache httpd, Nginx and IIS editions (excluding FreeBSD) from 2.20 before 8.00 Update 5, and FreeBSD editions for Apache httpd and Nginx from 2.20 before 7.00 Update 6. IIS editions 3.10 through 4.00 Update 4 are not affected.
Is a patch available?
Yes. The vendor released a patch that replaces the files used in statistics processing, including for end-of-life versions, and advises saving diagnostic information as evidence before patching.