Affected Systems

SiteGuard Server Edition for Apache httpd, Nginx, and IIS (excluding FreeBSD) versions 2.20 through 8.00 Update 4; FreeBSD editions 2.20 through 7.00 Update 5. Vulnerability requires statistics function to be enabled (default). IIS editions 3.10 through 4.00 Update 4 are NOT affected. Approximately 1.5 million websites potentially at risk.

Exploitation Status

Active exploitation confirmed in the wild by vendor (SiteGuard) and JPCERT/CC. Attacker identity, victim count, and attack methods not disclosed. Vendor notified direct support customers on September 29, 2026; public disclosure October 18, 2026.

Business Impact

Critical risk for organizations running vulnerable SiteGuard WAF instances. OS command injection allows unauthenticated remote attackers to execute arbitrary commands with root (Linux) or SYSTEM (Windows) privileges. This enables full server compromise, data exfiltration, lateral movement, and persistent backdoor installation. WAF products are high-value targets as they sit at network perimeters and often have visibility into multiple backend systems. Remediation may erase forensic evidence of compromise.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately identify all SiteGuard Server Edition instances in your environment (versions 2.20 through 8.00 Update 4 for Apache/Nginx/IIS; 2.20 through 7.00 Update 5 for FreeBSD).
  • Before patching, download diagnostic information from Web management screen → Diagnostic information → Download diagnostic information to preserve forensic evidence.
  • Upgrade to SiteGuard Server Edition 8.00 Update 5 (or 7.00 Update 6 for FreeBSD) immediately, or apply vendor-provided patch for end-of-life versions from SiteGuard support portal.
  • Review system logs, web server access logs, and process execution logs for suspicious command execution or unauthorized access since September 29, 2026.
  • Conduct incident response investigation on all vulnerable instances to identify indicators of compromise, including unexpected processes, new user accounts, scheduled tasks, or outbound network connections.