Hackers exploit SiteGuard WAF flaw to run commands as admins

Attackers are exploiting an OS command-injection vulnerability in SiteGuard Server Edition, a widely used web application firewall, to execute commands with root or SYSTEM privileges, BleepingComputer reports. The critical flaw (CVE-2026-106931) affects the product’s statistics function, which is enabled by default; the vendor and Japan’s CERT confirm abuse in the wild, and patches are available.