Attackers exploit SiteGuard firewall flaw to execute privileged commands

Attackers are exploiting a command-injection flaw in SiteGuard Server Edition that lets them run commands with root or SYSTEM privileges, according to the vendor and Japan's CERT agency. Tracked as CVE-2026-106931, the vulnerability affects the firewall's statistics feature, which is enabled by default. Affected versions start at 2.20, with fixes in 8.00 Update 5 for non-FreeBSD installations and 7.00 Update 6 for FreeBSD. JPCERT/CC says IIS editions 3.10 through 4.00 Update 4 are exempt. The vendor also offers replacement-file patches, including for end-of-life versions. Administrators should preserve diagnostic information before remediation because patching may erase attack traces. The attackers, victims and scale of exploitation remain unclear.